CVE-2022-35912: In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (...

Security readout for executives and security teams

Grails applications on affected versions may let a remote attacker turn normal data-binding input into code execution by reaching the class loader. The sources identify fixed Grails versions, but the record does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in internet-facing or API-exposed Grails applications running affected framework versions, especially where Java 8 configurations match the advisory conditions. Treat this as urgent for any exposed Grails application because the stated impact is remote code execution. Prioritize discovery and upgrade, while noting that active exploitation is not evidenced in the supplied sources. Mitigation focus: Upgrade Grails to 3.3.15, 4.1.1, 5.1.9, 5.2.1, or later as applicable.; Prioritize exposed Grails applications and systems handling untrusted request data.; Review the Grails advisory and blog for branch-specific upgrade guidance..

Prepared

Jun 2, 2026, 08:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.