The vulnerability stemmed from constructing a system command via string interpolation of user-controlled 'options.source' input passed to child_process.exec(). The pre-patch implementation in nativeZip() concatenated sources into a shell command without proper escaping. The commit 45d4a90 shows the fix: replacing exec() with spawn() and handling arguments as an array via expandSources(), which prevents shell interpretation. The use of exec() with unsanitized input in command strings is a well-known pattern for CWE-78 vulnerabilities.