The vulnerability stems from insufficient validation in the validateAgainstBlockMethodBlacklist method. The original code compared the full 'BlockClass::method' string, which could be bypassed by injecting a different block class name while retaining the forbidden method name. The patch modifies this logic to extract only the method name after '::', ensuring proper validation. Since this function is directly responsible for blocking dangerous block methods, its flawed implementation allowed command injection. The commit diff and CWE-77 context confirm this is the root cause.