The vulnerability stemmed from the XML parser's output being directly assigned to req.body without prototype pollution safeguards. The patch added explicit deletion of proto, constructor, and prototype properties before assignment. The original vulnerable code path was the unconditional 'req.body = xml || req.body' line in index.js, which failed to sanitize prototype chain manipulation vectors. The tests added in test.js confirm the attack vectors targeted these prototype-related properties.