The vulnerability stems from how Bootstrap's button plugin handles data-*-text attributes during state changes. The Button.prototype.setState function is responsible for updating button text when entering loading state, using jQuery.html() method with raw attribute values. This bypasses input sanitization as evidenced by the PoC where user-controlled input from data attributes gets executed as HTML. The first patched version (3.4.1) likely introduced sanitization in this state transition logic.