Skip to main content
Exploitation reportedNot in CISA KEV yetFix available

CVE-2022-42889

Exploitation reported by one source. First attested on 2022-10-20 by GCVE · kevintel.

  • Published2022-10-13
  • Fixed in7.5.0
  • WeaknessCWE-94

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Timeline

dates in UTC
  1. 2022-10-1313:15CVE publishedNVD
  2. 2022-10-2011:40Listed as exploited by GCVEGCVE
  3. 2022-10-2011:40Exploitation first reportedGCVE
  4. 2025-04-18Exploit-DB entryExploit-DB

Observed activity

isMalicious corpus · updated 2026-11-03 15:37 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2022-42889?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2022-42889?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD · OSV
Juniper security threat response managerversion to verify
BranchAffectedFixed in
7.5< 7.5.07.5.0
7.5= 7.5.0no fix published
Apache commons text
BranchAffectedFixed in
1.x≥ 1.5, < 1.10.01.10.0
Netapp bluexp
BranchAffectedFixed in
—all versionsno fix published

1 more product in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA1 product

As apache, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • Apache Software Foundation Apache Commons Text
    Affected
    • ≤ 1.9no fix statedcustom
    • ≥ 1.5, < Apache Commons Text*fixed in Apache Commons Text*custom

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2024-01-19

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • ansible-collection-redhat-satelliteRed Hat:satellite:6.13::el8all versions · fixed in 0:3.9.0-2.el8sat
  • ansible-collection-redhat-satelliteRed Hat:satellite_capsule:6.13::el8all versions · fixed in 0:3.9.0-2.el8sat
  • ansible-collection-redhat-satellite_operationsRed Hat:satellite:6.13::el8all versions · fixed in 0:1.3.0-2.el8sat
  • ansible-collection-redhat-satellite_operationsRed Hat:satellite_capsule:6.13::el8all versions · fixed in 0:1.3.0-2.el8sat
  • ansible-lintRed Hat:satellite:6.13::el8all versions · fixed in 0:5.0.8-4.el8pc
  • ansible-lintRed Hat:satellite_capsule:6.13::el8all versions · fixed in 0:5.0.8-4.el8pc
  • ansible-runnerRed Hat:satellite:6.13::el8all versions · fixed in 0:2.2.1-3.el8satand 1 other package
  • ansible-runnerRed Hat:satellite_capsule:6.13::el8all versions · fixed in 0:2.2.1-3.el8sat

518 more package ranges on OSV.dev

Vendor advisories

  • CVE-2022-42889 Red Hat Product Security129 products fixed · 5 known affected

    apache-commons-text: variable interpolation RCE

    commons-text as a component of Red Hat Integration Camel K 1 · commons-text as a component of Red Hat JBoss Enterprise Application Platform 7 · commons-text as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack · +2 more

  • RHSA-2025:1747 Red Hat Product Security52 products fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update

  • RHSA-2025:1746 Red Hat Product Security37 products fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update

  • RHSA-2024:3527 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat AMQ Streams 2.7.0 release and security update

  • RHSA-2024:0775 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

  • RHSA-2024:0778 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

20 more advisories

Full record on NVD

Fix

  1. Update Juniper security threat response manager to 7.5.0
  2. Vendor fix Red Hat Product Security RHSA-2025:1747 · 52 productsBefore applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access…
  3. Vendor fix Red Hat Product Security RHSA-2025:1746 · 37 productsBefore applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access…
  4. Vendor fix Red Hat Product Security RHSA-2024:3527 · 1 productBefore applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
  5. Vendor fix Red Hat Product Security RHSA-2024:0775 · 2 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
  6. Vendor fix Red Hat Product Security RHSA-2023:7288 · 2 productsBefore applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
  7. Vendor fix Red Hat Product Security RHSA-2023:2097 · 3 productsFor Red Hat Satellite 6.13, see the following documentation for the release. https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13 The important instructions on how to upgrade are available below. https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_an…

Advisories and patches

Detection

read 2026-11-02 22:42 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
EDB-52261
Exploit-DB
Proof-of-concept repositories
20 repositories, unverifiedSeanWrightSec/CVE-2022-42889-PoCchainguard-dev/text4shell-policytulhan/commons-text-goatkarthikuj/cve-2022-42889-text4shell-dockerClickCyber/cve-2022-42889
PoC-in-GitHub
Metasploit modules
1 moduleexploit/multi/http/apache_commons_text4shellrank: excellentModule metadata: Metasploit Framework, © Rapid7, Inc., BSD-3-Clause.
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
2022-10-13
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-599f-7c49-w659

Frequently asked questions

What is CVE-2022-42889?

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Is CVE-2022-42889 actively exploited?

Active exploitation of CVE-2022-42889 has not been confirmed. Its EPSS score was 99.9% on 2026-11-03, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-42889?

CVE-2022-42889 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Running apache-commons-text? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record