The vulnerability in dromara lamp-cloud (<=5.6.2) involves improper control over code generation in the GlueFactory component. Specifically, Groovy scripts stored in database template fields are executed without sandboxing, compilation restrictions, or whitelisting. Attackers can write or influence these script fields via message template endpoints, enabling arbitrary Groovy code execution and consequently arbitrary OS command execution on the backend server. This constitutes a remote code execution flaw with a CVSS 4.0 score of 8.7 (high severity). The issue was fixed in commit 84b0c27, but no explicit patch or remediation guidance is included in the provided data.

Successful exploitation allows remote attackers to execute arbitrary Groovy scripts and OS commands on the backend server hosting the lamp-cloud platform. This can lead to full system compromise, data theft, or disruption of services. The vulnerability requires no user interaction and has low attack complexity, making it a significant risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 84b0c27, so upgrading to a version including this commit is recommended once available. Until then, restrict access to message template endpoints and validate or sanitize inputs to script fields to mitigate exploitation risk.