The vulnerability stems from missing CSP nonce attributes in script tags, which allowed XSS payloads to execute. The commit adds nonce handling in HeadScript.php's itemToString method, indicating this was the vulnerable point. The Twig templates (index.html.twig) were modified to include nonce attributes in all script tags, confirming that previously they were rendered without CSP protection. The HeadScript component's failure to include nonces in generated script tags before the patch directly enabled XSS exploitation.