Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

grails/grails-gsp

              7.0.x @ d656792
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

grails-plugin-gsp/src/ast/groovy/org/codehaus/groovy/grails/compiler/web/gsp/GroovyPageBytecodeOptimizer.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Server-Side Template Injection: Directly enables arbitrary code execution during GSP compilation if expression evaluation is not restricted.

Reflected XSS: Message arguments from user input rendered unescaped in g:message tag, leading to stored/reflected XSS.

Reflected XSS: Page title output unescaped in layoutTitle tag, allowing injection via title attribute.