Vigilbase CVEConnect your agent

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Not in CISA KEVMetasploit moduleCVE-2022-42889

Not confirmed exploited. 3 of 8 rule sources name it.

Edge rules
3/8
Our test
No exploit yet
CVSS
—
EPSS
99.9% Top 0.1%
Posts, 14d
02026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 0 posts2026-11-03: 0 posts
Published
2022-10-13
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of… More

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Ask Vigil

AI · answers from this page
Ask about CVE-2022-42889: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Severity, decoded

CISA's assessmentSSVC, from the CVE record
ExploitationNone

CISA has seen no public exploit and no attacks.

AutomatableYes

Attackers can script the attack end to end and hit many targets at once.

Technical impactTotal

A successful attack gives full control over the affected software or all of its data.

Public exploits

2 found
1 Metasploit1 Exploit-DB0 Scanner template0 GitHub PoCs

Links are to third-party code: never run it outside an isolated lab.

Timeline

  1. 2022-10-13
    CVE published
    CVE List
  2. 2022-10-13
    Metasploit module published
    Apache Commons Text RCE
  3. 2022-10-20
    AWS rule names it
    Earliest entry we can see is an update
  4. 2025-04-18
    Exploit published on Exploit-DB
    Apache Commons Text 1.10.0 - Remote Code Execution
  5. 2026-01-20
    F5 rule names it
    Earliest entry we can see is an update

Social

2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 0 posts2026-11-03: 0 posts

No posts seen yet on X, Bluesky, Mastodon, Hacker News or GitHub.

Vendor statements

Quoted
CloudflareWAF Managed RulesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

AWSAWS WAF Managed Rules1 quoteRule published

Named by 2022-10-20; the first entry is an update, so the rule may be older.

2022-10-20UpdatedSource
Known bad inputs managed rule group JavaDeserializationRCE_BODY JavaDeserializationRCE_URIPATH JavaDeserializationRCE_HEADER JavaDeserializationRCE_QUERYSTRING Host_localhost_HEADER: Released static version 1.17 of this rule group. Updated the Java deserialization rules to add detection for requests matching Apache CVE-2022-42889, a remote code execution (RCE) vulnerability in Apache Commons Text versions prior to 1.10.0. For more information, see NIST: National Vulnerability Database: CVE-2022…
Microsoft AzureFront Door and Application Gateway WAF (DRS)2 quotesRule published
UndatedListed932130Source
Rule 932130: Critical - 5 · PL1 · Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) or Text4Shell (CVE-2022-42889) Found
UndatedListed941210Source
Rule 941210: Critical - 5 · PL1 · XSS using obfuscated JavaScript or Text4Shell (CVE-2022-42889)
Google CloudCloud Armor preconfigured WAF rulesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

FastlyNext-Gen WAF virtual patchesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

F5Attack signatures (Distributed Cloud WAF)3 quotesRule published

Named by 2026-01-20; the first entry is an update, so the rule may be older.

2026-01-20Updated200104807Source
Updated: signature 200104807 "Apache Commons Configuration Lookup expression (Parameter)" (Server Side Code Injection, risk High), systems: Apache, Apache Tomcat, Apache Struts. References: CVE-2022-33980, CVE-2022-42889, CVE-2025-46295.
2026-01-20Updated200104808Source
Updated: signature 200104808 "Apache Commons Configuration Lookup expression (Header)" (Server Side Code Injection, risk High), systems: Apache, Apache Tomcat, Apache Struts. References: CVE-2022-33980, CVE-2022-42889, CVE-2025-46295.
2026-01-20Updated200104809Source
Updated: signature 200104809 "Apache Commons Configuration Lookup expression (URI)" (Server Side Code Injection, risk High), systems: Apache, Apache Tomcat, Apache Struts. References: CVE-2022-33980, CVE-2022-42889, CVE-2025-46295.
AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.