The vulnerability exists in the core sanitizeHtml function's handling of iframe src attributes. The patch adds validation logic directly in this function to address improper input validation of protocol-relative URLs containing backslashes and whitespace. The function signature matches the main export of the package, and the evidence shows direct modification to the attribute processing path for iframe elements. The tests demonstrate exploitation occurs through this code path when processing malicious src values.