CVE-2022-35912: Grails

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.

Affected products

• Grails Grails: from 3.3.10, before 3.3.15 (fixed in 3.3.15); from 4.0.0, before 4.1.1 (fixed in 4.1.1); from 5.0.0, before 5.1.9 (fixed in 5.1.9); version 5.2.0 only

Published 2022-07-19. Last modified 2026-06-17.