The vulnerability stems from unsafe handling of user-controlled attributes in video embedding functions. The commit diff shows these functions previously lacked input validation using regValidParam before constructing iframe HTML. Attackers could inject arbitrary JavaScript through malicious attribute values that would be directly inserted into innerHTML. The patch adds validation checks for these specific attributes in these functions, confirming their role in the vulnerability.