Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

grails/gorm-mongodb

              9.0.x @ 39450b8
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Multi-tenancy Isolation: 3 prior fixes. Scrutinize any change in this area.

MongoDatastore.java: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Dependency Upgrade: Spring Framework was upgraded twice in quick succession, indicating the project was running versions with known RCE vulnerabilities and needed to catch up to patched releases. The sink is the springVersion property, and the fixes were reactive rather than proactive.

Multi-tenancy Isolation: Dynamic finders were shared across tenants, allowing cross-tenant data leakage. The fix switched to tenant-specific finders, but the same risk could recur if any other shared static API or finder mechanism is introduced.

Multi-tenancy Isolation: Tenant IDs were not encoded/decoded in BSON codecs, meaning stored documents could mix tenants. The fix added TenantIdEncoder/Decoder, but any custom codec or bypass path could still omit tenant isolation.