The vulnerability stems from the set() function's path validation logic in main.js. The original fix for CVE-2022-22143 checked forbidden paths using startsWith(), which could be bypassed by adding arbitrary prefixes (e.g., 'foo.proto'). The commit diff shows the vulnerable code used 'k.startsWith(${path}.)' with path='proto', which failed to block 'foo.proto.polluted' since 'foo.proto.' doesn't start with 'proto.'. The patched version added trailing dots to forbidden paths and included an includes() check to detect nested dangerous paths, confirming the vulnerability resided in the set() function's validation logic.