This vulnerability affects the GroovyClassLoader.parseClass function in the Message Template Handler component of Dromara lamp-cloud up to version 5.6.2. Improper neutralization of special elements in the DefMsgTemplate.content argument can be exploited remotely to manipulate template processing. The vendor was contacted but has not provided a response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow remote attackers to manipulate template content processing, potentially leading to unintended code execution or information disclosure depending on the template engine's behavior. However, the exact impact details are not specified beyond improper neutralization of special elements. There are no known exploits in the wild, and no vendor mitigation or patch is currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying additional input validation or sanitization on DefMsgTemplate.content inputs as a temporary mitigation. Monitor official vendor channels for updates or patches.