The vulnerability stems from unary operators (And/Or) not escaping non-Expression arguments. The bug report example shows And([Literal(True), 'foo']) produces unsafe SQL with raw 'foo' instead of a parameter. The commit f20551bbb8b3 explicitly addresses unary operator parameter handling. Since And and Or are core unary operators in sql.operators, their operand processing logic (likely in init or string serialization) is the root cause. The high confidence comes from direct evidence in the bug report, CVE description, and commit message linking to these operators.