The vulnerability arises from user-controlled data (e.g., theme configurations) being embedded in HTML attributes without disabling AngularJS binding. The patch adds ng-non-bindable to anchor tags, which prevents Angular from processing injected expressions. The affected templates directly output data retrieved via methods like erLhcoreClassModelChatConfig::fetch() and $Result['theme'] properties. While htmlspecialchars neutralizes traditional XSS, Angular expressions (e.g., {{...}}) are not escaped by PHP and would execute if Angular processes the element. The lack of ng-non-bindable in the original code allowed this client-side exploitation.