The vulnerability stems from the extend function's unsafe property assignment logic (d[p] = v). This pattern is a known prototype pollution vector when handling untrusted input. The CVE description explicitly references the optionName variable as the attack vector, which would flow through this function. The code structure matches classic prototype pollution patterns in JavaScript utilities that merge objects without prototype checks. The linked line 2194 in main.js contains the extend implementation, confirming its role in the vulnerability.