The vulnerability stems from the hf_chat_template function using Jinja's default Environment() to render user-controlled templates. The commit diff shows the fix replaced Environment() with ImmutableSandboxedEnvironment, which confirms the original implementation lacked proper sandboxing. This allowed attackers to inject template code that executes arbitrary Python commands through specially crafted tokenizer_config.json files. The function's direct handling of external template input without safe rendering mechanisms makes it clearly vulnerable.