The vulnerability stems from missing HTML escaping in JSX fragment resolution. The commit diff shows critical changes where an escape() function was added to wrap parameters passed to resolveSSRNode in ErrorBoundary and Suspense. Prior to the patch, these components directly passed user-controlled data (like URL parameters) to resolveSSRNode without sanitization, allowing raw HTML injection. The example demonstrates XSS via {text()}, which would flow through these rendering paths. The functions ErrorBoundary and Suspense are explicitly modified in the patch to add escaping, confirming their role in the vulnerability.