CVE-2022-42889: Apache Commons Text interpolation allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and near-maximum EPSS make this a top remediation target despite absence from KEV.

What it is

Apache Commons Text versions 1.5 through 1.9 enable default StringLookup interpolators (script, dns, url) that can execute code or contact remote servers when untrusted values are interpolated. Applications relying on the default interpolation behavior are exposed to remote code execution. The flaw is fixed in 1.10.0, which disables the problematic interpolators by default.

Impact

An attacker who can influence interpolated input can execute arbitrary code in the JVM or force outbound requests to attacker-controlled or internal systems. This yields full compromise of confidentiality, integrity and availability of the affected application.

Attack surface

Reached over the network through any application path that passes untrusted configuration or user-supplied values into Commons Text interpolation. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is near maximum (0.99931, 99.969th percentile) and public references include a Packet Storm remote code execution write-up, indicating active interest and likely exploit availability.

What to do

• Upgrade Apache Commons Text to 1.10.0 or later, which disables the script, dns and url interpolators by default.
• If immediate upgrade is not possible, remove or restrict the default interpolators by constructing a custom StringSubstitutor with an explicit, minimal StringLookup set.
• Audit application code and configuration for untrusted values passed into StringSubstitutor or interpolated strings, and sanitize or reject ${...} patterns from external input.
• Track vendor advisories for bundled products (NetApp BlueXP, Juniper Security Threat Response Manager) and apply their patched releases.
• Restrict outbound network access from application servers to limit dns and url lookup abuse.

Detection

• Search application and dependency inventories for Apache Commons Text versions 1.5 through 1.9.
• Monitor logs and process telemetry for JVM script engine invocation or unexpected child processes spawned by Java applications.
• Alert on outbound DNS or HTTP requests originating from application servers to unusual or internal destinations.
• Inspect request and configuration inputs for ${script:, ${dns: or ${url: interpolation patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.