Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell

Quick Answer — Days after Log4Shell’s cousin surfaced, October 2022 brought Text4Shell (CVE-2022-42889): a code-execution bug in Apache Commons Text caused by the library’s string-interpolation feature processing attacker-controlled input. The CVSS panic said 9.8; reality said far narrower than Log4Shell — exploitation required the app to pass untrusted input into Commons Text’s lookup features, which most apps never did. The namesake was marketing; the real story is why severity scores mislead when reachability is everything. Patched in Commons Text 1.10.0. The lesson: score-driven triage wastes your scarcest resource — reachability analysis is the triage. (Note: this article covers a security event; see web vulnerability primers for background.)

Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)

What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today

What happened

Per the Apache advisory, the original GitHub issue, and contemporaneous analysis:

• The bug. Apache Commons Text includes StringSubstitutor, which interpolates templates like ${script:...}, ${dns:...}, and ${url:...}. If an application passed attacker-controlled strings through this interpolation, the lookups would execute — script evaluation, DNS lookups, outbound HTTP. CVSS math spat 9.8; the condition (“app pipes user input into StringSubstitutor with those lookups enabled”) was rare.
• The name. “Text4Shell” was coined by analogy to Log4Shell, nine months after its namesake traumatized the industry. The branding helped awareness and hurt proportion: many orgs burned a weekend on a bug their codebase couldn’t reach.
• The fix. Commons Text 1.10.0 changed the default interpolator set to disable the dangerous lookups out of the box. Simple, clean, and — because dependency version pins lag everywhere — still the reason the CVE pops up in scanners into 2024.

Impact and numbers

Why CVSS said 9.8 and the world said “check first”

CVSS measures worst-case: if the vulnerable code path is reachable with attacker input, the impact is code execution. It does not measure whether the path is reachable in your app. Commons Text’s interpolation is a library feature most applications never invoke on user input — think of a template engine nobody configured. The gap between “critical if reachable” and “reachable” is where security teams live post-2022: reachability analysis (calls-graph tools, SBOM-plus-context scanning) became the standard answer to “do we actually patch this tonight?” Text4Shell is the cleanest teaching example, because the entire industry did the analysis in public, at the same time, and mostly concluded “we’re not affected — and here’s the proof.”

Timeline

Why it still matters in 2026

Because the Text4Shell pattern — high CVSS, low reachability, mass panic, then quiet relief — now has a named counter: reachability-based triage. Modern SCA platforms score vulnerabilities against your actual call paths; “critical but unreachable” ranks below “medium but on your auth path.” The episode also fed two durable practices: treating disclosure timing ethics carefully (the CVE dropped before many had upgraded; mid-cycle disclosure burns goodwill) and establishing library feature inventories — knowing which of your dependencies’ optional features you actually use, before a CVE names one. When the next “-4Shell” trends, the 2026 answer is a reachability report in an hour, not an all-hands weekend.

The bug, in one diagram

 attacker input
      |
      v
 app passes string to
 StringSubstitutor
      |
      v
 ${script:...} lookup
 ${dns:...} lookup
 ${url:...} lookup
      |
      v
 code exec / SSRF /
 DNS exfil channel
 
 fix 1.10.0: dangerous
 lookups OFF by default

 key question: does YOUR
 app ever interpolate
 untrusted strings?
 (most: no)

Detection and hardening takeaways

• Build reachability into triage. Base patch priority on whether your code invokes the vulnerable path, not base severity alone.
• Maintain a library feature inventory. Know which optional features your apps use — interpolation engines, deserializers, script evaluators — so CVE news maps to yes/no instantly.
• Pin and upgrade deliberately. Stale version pins are why “fixed in 1.10.0” still alerts in 2026; dependency-update automation closes the tail.
• Watch for the exfil channels. If you do use interpolation on user input, monitor DNS and outbound-HTTP oddities from app servers — those lookups are the tell.
• Don’t let branding set your posture. “-4Shell” names raise heat, not risk; the risk calculus is reachability, period.

Was Text4Shell actually exploited?

PoCs and internet-wide scanning appeared within hours of disclosure — the usual proof-of-life for any web-reachable string sink. But no significant breach was publicly attributed to CVE-2022-42889 in the disclosure window. The mismatch between the scramble and the outcome is precisely why the episode is remembered as a triage lesson rather than an incident.

How is this different from Log4Shell?

Same family (Java library, string-interpolation sink), different adoption. Log4j’s vulnerable lookups ran on every logged string by default — effectively all apps using Log4j for user-driven messages were reachable. Commons Text’s interpolation was an opt-in feature most apps never touched. Identical severity scores; opposite real-world footprints. The comparison is the fastest way to teach why base CVSS can’t be the whole triage.

Are we wrong to patch everything critical?

No — patch depth-first where unreachable is cheap insurance; the error is treating unreachable-critical as an emergency that outranks reachable-moderate. The resource being spent isn’t just engineer-hours: it’s attention, change-window risk, and the credibility you’ll need for the next truly urgent night. Triage is priorities under scarcity; Text4Shell is the case that made the industry say it out loud.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.

Where this sits in the broader pattern

Text4Shell (CVE-2022-42889, October 2022) — the Apache Commons Text lookup-injection flaw that arrived ten months after Log4Shell wearing the same 9.8 — is the definitive severity-context lesson. The library was less ubiquitous, exploitation required specific application conditions, and the practical impact was a fraction of its predecessor. The industry response, though, was revealing: muscle memory from Log4Shell drove a faster, more disciplined response than the actual risk warranted — and that miscalibration taught the triage lesson this series keeps repeating.

The pattern generalizes into the CVSS-versus-exposure doctrine. Scores measure theoretical primitives; incidents require reachability, data flow, and exploit conditions. The mature pipeline that emerged from the 2022 string of inflated 9.8s: automated inventory (what runs this library), reachability analysis (what input reaches the vulnerable path), and exploit-condition verification (does our configuration enable the primitive) — before emergency mobilization. Teams that built that pipeline for Log4Shell used it for Text4Shell in hours and went back to sleep; teams that had not built it woke up twice for the same lesson.

The consolidation with the F5 smuggling entry: severity inflation has costs — credibility, budget, and the response-fatigue that makes the next all-hands meeting harder to convene. The discipline is translation, not reaction: every advisory becomes an architecture-conditioned exposure statement, and the emergency tier is reserved for exposures that survive the translation.

The bottom line. The 9.8 that was not Log4Shell — same score, tenth the reachability, and the whole industry responding to the previous war. Build the inventory-and-reachability pipeline once, translate every advisory into an exposure statement, and spend the emergency tier on emergencies. Panic is not a patch; it is a rehearsal deficit.

The response-pipeline that Log4Shell bought and Text4Shell tested

The most useful lens on Text4Shell is as the first live test of the Log4Shell remediation pipeline. Organizations emerged from December 2021 with three new capabilities: software-composition inventories (SBOMs, dependency trees), reachability analysis habits, and the organizational muscle memory of a coordinated library-response. Text4Shell exercised all three against a much smaller threat — and the performance differences were diagnostic. Teams with real SBOMs answered where do we use Commons Text in minutes and went back to sleep; teams with spreadsheet approximations spent the weekend reconciling conflicting inventories for a vulnerability most of them could not trigger.

The economics of that difference deserve emphasis: the pipeline cost weeks to build after Log4Shell and saved days on Text4Shell — and its value compounds with every subsequent library advisory, because the response becomes lookup rather than archaeology. The XZ incident later demonstrated the same inventory answering a different question (who maintains this), which is the fuller argument: dependency metadata — versions, reachability, maintainership — is the raw material of supply-chain security, and every incident of the era was either easier or harder depending on whether it existed.

The closing calibration for leadership: fund the pipeline, not the panic. Every dollar spent on dependency intelligence amortizes across every future advisory; every dollar spent on emergency response amortizes once. Text4Shell was the coupon that proved the purchase — a 9.8 that cost prepared organizations an afternoon and unprepared ones a weekend, with the delta entirely attributable to infrastructure built for a different vulnerability.

The coupon redeemed, the pipeline amortized, the panic retired — Text4Shell closed the Log4Shell arc by proving its remediation had been infrastructure rather than adrenaline. Build infrastructure for the next one; the next one is already in a dependency tree near you.

Frequently Asked Questions

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What is Text4Shell CVE-2022-42889?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”A code-injection flaw in Apache Commons Text StringSubstitutor lookup interpolation, disclosed October 2022 with a 9.8 CVSS score, allowing remote code execution in applications that interpolated attacker-controlled strings through specific library usage.”}},{“@type”:”Question”,”name”:”Was Text4Shell as dangerous as Log4Shell?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”No — despite the identical 9.8 score. Commons Text was less widely deployed, and exploitation required specific application patterns that passed attacker input through the vulnerable interpolation, so real-world exposure was far narrower.”}},{“@type”:”Question”,”name”:”What is the lesson of Text4Shell for vulnerability response?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”That CVSS scores need translation into architecture-conditioned exposure — inventory, reachability, and exploit-condition analysis — before emergency mobilization, reserving the incident-response tier for advisories that survive the translation.”}}]}

More on this topic

• Spring4Shell: The RCE That Wasn’t Log4Shell (but Still Bit Hard)
• GitHub’s OAuth supply chain: the Heroku Token Heist That Reached
• Tool Hijacking: The 2024 Papers That Predicted Agent Attacks

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy