The vulnerability stems directly from enabling nodeIntegration in Electron's BrowserWindow configuration. This setting allows the renderer process to access Node.js APIs, which when combined with untrusted content rendering (markdown files), enables RCE through constructs like require('child_process').exec(). The main.js file is Electron's main process entry point where window configuration typically occurs. While no specific function names are provided in available sources, the BrowserWindow instantiation with insecure settings is the root cause.