Skip to content
CVE IDCVE-2022-42889GitHub advisory IDGHSA-599f-7c49-w659

Arbitrary code execution in Apache Commons Text

CVE-2022-42889 (GitHub advisory GHSA-599f-7c49-w659) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Control of Generation of Code ('Code Injection') (CWE-94), in org.apache.commons:commons-text (Maven) and com.guicedee.services:commons-text (Maven). It is fixed in 1.10.0.

Critical9.8Fix availableGitHub reviewed

Published 13 Oct 2022Updated 20 Nov 2024

9.8CriticalCVSS 3.1
CVE ID
CVE-2022-42889
GHSA ID
GHSA-599f-7c49-w659
EPSS
99.93%higher than 99.9% of CVEs
Weakness (CWE)
  • CWE-94Improper Control of Generation of Code ('Code Injection')
KEV status
Not in KEV
Published
13 Oct 2022
Updated
20 Nov 2024
Ecosystem
  • Maven
Assigned by (CNA)
apache

Summary

Source: OSV (GitHub advisory)

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Critical9.8Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
High
Integrity I
High
Availability A
High

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • org.apache.commons:commons-text
    Maven
    pkg:maven/org.apache.commons/commons-text
    Affected versions
    >= 1.5, < 1.10.0
    Fixed in
    1.10.0
    Show 5 listed versions
    • 1.5
    • 1.6
    • 1.7
    • 1.8
    • 1.9
  • com.guicedee.services:commons-text
    Maven
    pkg:maven/com.guicedee.services/commons-text
    Affected versions
    <= 1.2.2.1-jre17
    Fixed in
    None after 1.2.2.1-jre17
    Show 445 listed versions
    • 0.70.0.1
    • 0.70.0.1-rc1
    • 0.70.0.1-rc13
    • 0.70.0.1-rc14
    • 0.70.0.1-rc15
    • 0.70.0.1-rc2
    • 0.70.0.1-rc3
    • 0.70.0.1-rc4
    • 0.70.0.1-rc5
    • 0.70.0.2
    • 0.70.0.3
    • 0.70.0.4

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 1.10.0 or later.

Not fixed yet for: com.guicedee.services:commons-text.

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 9397c1cRelease commit1.10.0github.com/apache/commons-text

Vulnerability intelligence

References

Questions about CVE-2022-42889

What is the GHSA ID for CVE-2022-42889?
GitHub tracks CVE-2022-42889 as GHSA-599f-7c49-w659.
What is the CVSS score of CVE-2022-42889?
CVE-2022-42889 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Which versions are affected by CVE-2022-42889?
org.apache.commons:commons-text (Maven): >= 1.5, < 1.10.0. com.guicedee.services:commons-text (Maven): <= 1.2.2.1-jre17.
How do I fix CVE-2022-42889?
Upgrade to 1.10.0 or later.
What is the Package URL (PURL) for CVE-2022-42889?
The affected packages' PURLs are pkg:maven/org.apache.commons/commons-text and pkg:maven/com.guicedee.services/commons-text.
Is CVE-2022-42889 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-42889. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (15 Oct 2026, 01:51 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.