The key evidence comes from the commit diff showing replacement of v-html with v-text in table-body.vue. Vue's v-html directive directly interprets HTML without sanitization, making it XSS-prone when rendering user-controlled data. The patch specifically addresses this by switching to text interpolation which auto-escapes content. The file path and component match the vulnerability context described in the advisory.