Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
grails/grails-core
7.0.x @ 984e747
2
Fixes
3
CVEs
CRITICAL
Peak severity
Highlights
Mass Assignment: 2 prior fixes. Scrutinize any change in this area.
grails-web-databinding: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Mass Assignment: Insecure default configuration and property filtering in the databinding helper can expose sensitive domain fields such as 'id' and 'version' to mass assignment when domain classes inherit from abstract base classes. This allows attackers to manipulate internal object identifiers and version states.
Mass Assignment: The data binding runtime can erroneously bind critical identity properties on domain classes inheriting from abstract bases (like those annotated with @DirtyCheck) if path-based exclusions are not strictly applied during runtime data binding.
Remote Code Execution: Insecure databinding allows remote attackers to access class loaders and execute arbitrary code under specific Java configurations, as highlighted by CVE-2022-35912.