The vulnerability stems from how yargs-parser's core parsing logic handles object notation in arguments. The commit diff shows key sanitization was added to the parse function in index.js, specifically replacing 'proto' with 'proto' during key processing. Before this fix, the code path handling dot-notation keys (keys.slice().forEach() and key assignment) didn't prevent prototype pollution through 'proto' properties. The test cases added in the commit verify that prototype pollution is prevented by checking Object.prototype modifications, confirming the parse function's key handling was the vulnerable component.