CVE-2021-41132: Inconsistent input sanitisation leads to XSS vectors

The vulnerability stems from two primary patterns: 1) Use of jQuery.html() with unsanitized user input in JavaScript files, and 2) Underscore template interpolation using <%= instead of <%- for HTML context. The commit diff shows systematic replacement of unsafe practices: adding .escapeHTML() to JavaScript string injections and switching template interpolators. Vulnerable functions are those that handled user-controlled data (labels, names, textValues) without these sanitization measures in prior versions. High confidence comes from direct correlation between patched locations and XSS vulnerability patterns described in advisories.