The vulnerability stems from the remove_from_shelf function in shelf.py, where pre-patch versions included shelf.name in error messages (lines 217-221). The GitHub patch shows these lines were modified to remove shelf.name interpolation. The CVE description specifically references line 221 in shelf.py as the vulnerable location, and the commit diff confirms the sensitive data exposure was in this function's error handling logic. The function's permission check failure path directly leaked shelf names through both logging and user-facing error messages.