The vulnerability stems from unsafe JSON serialization of transfer state that gets written directly into HTML. Based on Angular transfer state patterns and Scully's architecture:

1. TransferStateService.serializeTransferState would handle the vulnerable JSON.stringify() call
2. RenderUtils.injectTransferState would execute the actual unsafe DOM insertion These functions would appear in stack traces when malicious payloads are processed during static page generation. The high confidence comes from the direct match between the vulnerability description (unsafe JSON.stringify usage) and standard Angular transfer state implementation patterns.