The key vulnerability stemmed from the processing order in simplePurifier. The original implementation decoded HTML entities before sanitization with DOMPurify, creating an XSS bypass opportunity. The patch swapped these steps (DOMPurify first, then entity decoding), which is the correct security-critical sequence. The commit message explicitly references fixing XSS in folder pages, and the functions.js modification directly addresses the output encoding flaw described in CWE-116.