The vulnerability stems from missing recursion depth management in function call handling. The commit diff shows 'defer!' blocks added to increment a 'global.level' counter in 4 locations within src/func/call.rs, indicating these were points where recursive calls weren't properly tracked. The stack trace shows repeated calls between eval_stmt_block and call_script_fn, while the test case demonstrates recursion through closure methods. Both functions are part of the call chain that failed to enforce recursion limits, making them root causes.