{"id":"CVE-2022-35912","details":"In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.","aliases":["GHSA-6rh6-x8ww-9h97"],"modified":"2026-08-27T08:14:50.428034Z","published":"2022-07-19T15:56:59Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35912.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35912.json"},{"type":"ADVISORY","url":"https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35912"},{"type":"REPORT","url":"https://github.com/grails/grails-core/issues/12626"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/07/20/4"},{"type":"ARTICLE","url":"https://grails.org/blog/2022-07-18-rce-vulnerability.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/grails-core","events":[{"introduced":"f05fd73bd24f63fa95c0f5dbd74ad31526aa53e9"},{"fixed":"b062a5cfe95835ea43217561db5ab8fa34aefe2b"},{"introduced":"b6337fc5ec6c38c04aad8f802a7b345325a24711"},{"fixed":"1e3c7077e0c773bd6f20f6f73d332e890abc0c50"},{"introduced":"10252ac29a53968cb14380078386089185cb514c"},{"fixed":"2279cc53db82674fc3bf527b4c9a8a071ffd7942"},{"introduced":"0481c70c7e9514dc4201e20f7fa3f21818cad34b"},{"last_affected":"0481c70c7e9514dc4201e20f7fa3f21818cad34b"}],"database_specific":{"extracted_events":[{"introduced":"3.3.10"},{"fixed":"3.3.15"},{"introduced":"4.0.0"},{"fixed":"4.1.1"},{"introduced":"5.0.0"},{"fixed":"5.1.9"},{"introduced":"5.2.0"},{"last_affected":"5.2.0"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:*","cpe:2.3:a:grails:grails:5.2.0:*:*:*:*:*:*:*"]}}],"versions":["5.2.0","v5.1.8","v5.2.0","v4.1.0","v5.1.7","v5.1.6","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","archive/master","v4.0.13","v5.0.1","v5.0.0","v4.0.12","v3.3.14","v3.3.13","v4.0.11","v4.0.10","v4.0.9","v4.0.8","v3.3.11","v4.0.7","v3.3.12","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.3.10"],"database_specific":{"vanir_signatures_modified":"2026-08-27T08:14:50Z","vanir_signatures":[{"target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["133658545622022813691893546492822193591","231968117220509831045687927920220568529","322518850141335907120383407016704122099","68221056247180651435663117672102194603"],"threshold":0.9},"id":"CVE-2022-35912-07f35209","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/1e3c7077e0c773bd6f20f6f73d332e890abc0c50"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/b062a5cfe95835ea43217561db5ab8fa34aefe2b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"86599955727034140749407227730922538923","length":89},"id":"CVE-2022-35912-0fc45d9e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/2279cc53db82674fc3bf527b4c9a8a071ffd7942","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["265527345752929269959675063536228266316","253657430198469265743706077559009248439","235959779190895364226641945778270050068","317079240568775686040492947509911246572"],"threshold":0.9},"id":"CVE-2022-35912-25a5f26e"},{"digest":{"function_hash":"337336054825846849060651794846366540003","length":82},"id":"CVE-2022-35912-a40096a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/1e3c7077e0c773bd6f20f6f73d332e890abc0c50","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false},{"source":"https://github.com/apache/grails-core/commit/b062a5cfe95835ea43217561db5ab8fa34aefe2b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["168448992433160026276914504092498461111","212024600673281245820970122453290818013","24168885317386346339111550118646531829","57181071602607972446226234243744107833"],"threshold":0.9},"id":"CVE-2022-35912-e8f2e693","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/apache/grails-core/commit/2279cc53db82674fc3bf527b4c9a8a071ffd7942","target":{"function":"testGrailsVersion","file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"function_hash":"294856197498714873664731451451100738900","length":82},"id":"CVE-2022-35912-fb932cdf","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35912.json"}}],"schema_version":"1.9.0"}