The vulnerability stemmed from how non-string inputs (particularly arrays) were handled in the escape function. The pre-patch implementation:

1. Used generic typing (T extends SafeValue) that preserved input types
2. Only escaped strings and SafeValue instances
3. Returned other types (like arrays/numbers) unmodified This allowed attackers to pass arrays containing malicious payloads that bypassed sanitization. The patch fixed this by:

• Changing return type to always be string
• Converting all non-SafeValue inputs to strings before escaping
• Adding tests demonstrating proper array/object handling Both the concrete implementation (Template.escape) and its interface (TemplateContract.escape) needed modification to enforce correct type handling.