The vulnerability stems from two key unsafe code evaluation patterns: 1) Use of Groovy's Eval.me which directly executes arbitrary Groovy code, and 2) Use of Spring's SpEL parser with full evaluation context. Both were identified in the plugin condition handling logic (SpELExpressionEvaluator class) where user-controlled expressions were processed without proper sandboxing or input validation. The CVE description and mitigation PR #2576 explicitly reference these unsafe evaluation methods being patched by implementing input validation and switching to safer evaluation contexts.