The vulnerability exists due to lack of sanitization of user-supplied values, such as parser field names and encoding parameters, when JavaScript parser code is dynamically generated at runtime using the Function constructor. The npm library builds JavaScript source code as a string representing parsing logic and compiles it using the Function constructor, caching it as an executable function. Attacker-controlled input can make its way to the generated code without adequate validation, causing the application to parse untrusted data and resulting in arbitrary code execution. Applications using only static, hard-coded parser definitions are not affected.