The vulnerability stems from the fromJSON function's unsafe handling of user input. The commit diff shows this function used eval() on raw user-controlled strings from JSON input to recreate function objects. As eval() executes any arbitrary code in the input strings, and the function accepted user-controlled rules argument without validation, this creates a code injection vector. Multiple sources (CVE, GHSA, Snyk, and the patch commit) explicitly identify fromJSON as the vulnerable entry point that was removed in the patched version.