The vulnerability exists in the synchronous request handling path of the send() method. The commit diffs (983cfc2 and ee1e81f) show the fix involved wrapping data with JSON.stringify() to prevent code injection. In vulnerable versions, user input was directly embedded into a Node.js child process command string via data.replace(/'/g, "\\'"), which was insufficient to prevent escaping. This allowed attackers to inject arbitrary JavaScript code when sending malicious payloads via xhr.send() in synchronous mode. The file path and function are explicitly referenced in CVE-2020-28502 descriptions and GitHub advisories.