The vulnerability stems from FastReport's script engine allowing unrestricted use of .NET reflection and interop features. Key indicators:

1. The advisory explicitly lists GetType, typeof, DllImport, LoadLibrary and GetProcAddress as problematic
2. The GHSL-2020-143 advisory demonstrates RCE through expression evaluation
3. The fix introduced a ScriptSecurity feature with keyword blocking
4. These functions enable type discovery, assembly loading, and native code execution - critical capabilities for arbitrary code execution
5. While exact file paths aren't visible in public sources, the functions' presence in report scripting context without authorization checks constitutes the core vulnerability