VulnCheck KEV: CVE-2022-42889

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation...

Apache Commons Text: Arbitrary Code Execution

Background Apache Commons Text is a library focused on algorithms working on strings. Description Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to...

CVE-2022-42889

The Apache Commons Text library (versions 1.5 through 1.9 ) is vulnerable to Remote Code Execution (RCE) or unintentional remote contact due to insecure default lookups in its variable interpolation feature. Specifically, the StringSubstitutor component allows properties to be dynamically evaluat...