The vulnerability stems from unsanitized data handling in report exporters. The pre-patch code in writer.py directly used user-supplied data from report_data in both CSV and Excel writers without neutralizing formula-initiating characters. The commit adds remove_unsafe_chars() to strip =, +, and - characters, confirming these functions previously lacked critical sanitization. The injection occurs specifically when these writer classes process and export user-controlled billing address data.