The vulnerability stems from missing CSP nonce attributes in script tags, which allowed XSS exploitation. The commit adds nonce handling through ContentSecurityPolicyHandler and modifies HeadScript::itemToString to include these nonces. In vulnerable versions (<10.4.0), this method lacked nonce injection, making any script tags generated through this helper (including those handling user-influenced content) vulnerable to XSS if output wasn't properly sanitized elsewhere. The Twig template changes adding {{ pimcore_csp.getNonceHtmlAttribute() }} confirm the injection point for hardening.