This vulnerability affects the Dromara lamp-cloud product up to version 5.6.2. It arises from improper neutralization of special elements used in the template engine, specifically in the GroovyClassLoader.parseClass function of the Message Template Handler. By manipulating the DefMsgTemplate.content argument, an attacker can exploit this flaw remotely. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided any advisory or patch, and no official remediation level is assigned.

The vulnerability allows remote attackers to manipulate template content in the affected component, which could lead to unintended execution or processing of template elements. The CVSS score of 5.3 reflects a medium impact with network attack vector, low complexity, no privileges required, and no user interaction needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected component or applying application-level input validation to mitigate exploitation risk.