The vulnerability stems from the XML/HTML parsing functions' failure to validate() input types. The GitHub patch shows these functions were modified to add explicit checks for string/buffer inputs, and the CVE description explicitly mentions parseXml as the vulnerable entry point. The pre-patch code paths for both FromHtml and FromXml in xml_document.cc contained the unsafe input handling logic that led to the crash scenario.