The vulnerability stems from improper path sanitization in the isRepositoryGitPath function. The original implementation used string(os.PathSeparator) which could be bypassed by using mixed path separators. The patch explicitly checks for both '/' and '\' separators, indicating the previous implementation failed to properly validate paths across different OS environments. This allowed attackers to manipulate .git directory contents (like SSH authorized_keys or hooks), leading to OS command injection through subsequent Git operations.