The vulnerability lies in how jupyter-remote-desktop-proxy configured TigerVNC. The provided commit 7dd54c25a4253badd8ea68895437e5a66a59090d directly addresses this by modifying the setup_websockify function in jupyter_remote_desktop_proxy/setup_websockify.py. This function prepares the arguments for launching the VNC server. The patch introduces a check to identify if the VNC server is TigerVNC (by checking for the absence of 'turbovnc' in its script content) and adds the -rfbport -1 argument. This argument explicitly tells TigerVNC not to open a TCP port. The absence of this argument in the vulnerable version (3.0.0) for TigerVNC is the root cause of the vulnerability, making the setup_websockify function the direct location where the vulnerable configuration was applied.