The vulnerability stems from improper command construction when passing options to esbuild. While exact code changes aren't visible, the advisory explicitly states the root cause was insecure config.php passing replaced by proper array-based argument handling in v1.0.0. The most likely vulnerable points are: 1) Direct esbuild execution functions using string-based command assembly 2) CLI entry points processing user inputs. These would appear in runtime traces during command injection attempts as they handle user-provided build parameters before vulnerable command assembly occurs.