Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell

Quick Answer — Days after Log4Shell’s cousin surfaced, October 2022 brought Text4Shell (CVE-2022-42889): a code-execution bug in Apache Commons Text caused by the library’s string-interpolation feature processing attacker-controlled input. The CVSS panic said 9.8; reality said far narrower than Log4Shell — exploitation required the app to pass untrusted input into Commons Text’s lookup features, which most apps never did. The namesake was marketing; the real story is why severity scores mislead when reachability is everything. Patched in Commons Text 1.10.0. The lesson: score-driven triage wastes your scarcest resource — reachability analysis is the triage. (Note: this article covers a security event; see web vulnerability primers for background.)

What happened

Per the Apache advisory, the original GitHub issue, and contemporaneous analysis:

• The bug. Apache Commons Text includes StringSubstitutor, which interpolates templates like ${script:...}, ${dns:...}, and ${url:...}. If an application passed attacker-controlled strings through this interpolation, the lookups would execute — script evaluation, DNS lookups, outbound HTTP. CVSS math spat 9.8; the condition (“app pipes user input into StringSubstitutor with those lookups enabled”) was rare.
• The name. “Text4Shell” was coined by analogy to Log4Shell, nine months after its namesake traumatized the industry. The branding helped awareness and hurt proportion: many orgs burned a weekend on a bug their codebase couldn’t reach.
• The fix. Commons Text 1.10.0 changed the default interpolator set to disable the dangerous lookups out of the box. Simple, clean, and — because dependency version pins lag everywhere — still the reason the CVE pops up in scanners into 2024.

Impact and numbers

Why CVSS said 9.8 and the world said “check first”

CVSS measures worst-case: if the vulnerable code path is reachable with attacker input, the impact is code execution. It does not measure whether the path is reachable in your app. Commons Text’s interpolation is a library feature most applications never invoke on user input — think of a template engine nobody configured. The gap between “critical if reachable” and “reachable” is where security teams live post-2022: reachability analysis (calls-graph tools, SBOM-plus-context scanning) became the standard answer to “do we actually patch this tonight?” Text4Shell is the cleanest teaching example, because the entire industry did the analysis in public, at the same time, and mostly concluded “we’re not affected — and here’s the proof.”

Timeline

Why it still matters in 2026

Because the Text4Shell pattern — high CVSS, low reachability, mass panic, then quiet relief — now has a named counter: reachability-based triage. Modern SCA platforms score vulnerabilities against your actual call paths; “critical but unreachable” ranks below “medium but on your auth path.” The episode also fed two durable practices: treating disclosure timing ethics carefully (the CVE dropped before many had upgraded; mid-cycle disclosure burns goodwill) and establishing library feature inventories — knowing which of your dependencies’ optional features you actually use, before a CVE names one. When the next “-4Shell” trends, the 2026 answer is a reachability report in an hour, not an all-hands weekend.

The bug, in one diagram

 attacker input
      |
      v
 app passes string to
 StringSubstitutor
      |
      v
 ${script:...} lookup
 ${dns:...} lookup
 ${url:...} lookup
      |
      v
 code exec / SSRF /
 DNS exfil channel
 
 fix 1.10.0: dangerous
 lookups OFF by default

 key question: does YOUR
 app ever interpolate
 untrusted strings?
 (most: no)

Detection and hardening takeaways

• Build reachability into triage. Base patch priority on whether your code invokes the vulnerable path, not base severity alone.
• Maintain a library feature inventory. Know which optional features your apps use — interpolation engines, deserializers, script evaluators — so CVE news maps to yes/no instantly.
• Pin and upgrade deliberately. Stale version pins are why “fixed in 1.10.0” still alerts in 2026; dependency-update automation closes the tail.
• Watch for the exfil channels. If you do use interpolation on user input, monitor DNS and outbound-HTTP oddities from app servers — those lookups are the tell.
• Don’t let branding set your posture. “-4Shell” names raise heat, not risk; the risk calculus is reachability, period.

Was Text4Shell actually exploited?

PoCs and internet-wide scanning appeared within hours of disclosure — the usual proof-of-life for any web-reachable string sink. But no significant breach was publicly attributed to CVE-2022-42889 in the disclosure window. The mismatch between the scramble and the outcome is precisely why the episode is remembered as a triage lesson rather than an incident.

How is this different from Log4Shell?

Same family (Java library, string-interpolation sink), different adoption. Log4j’s vulnerable lookups ran on every logged string by default — effectively all apps using Log4j for user-driven messages were reachable. Commons Text’s interpolation was an opt-in feature most apps never touched. Identical severity scores; opposite real-world footprints. The comparison is the fastest way to teach why base CVSS can’t be the whole triage.

Are we wrong to patch everything critical?

No — patch depth-first where unreachable is cheap insurance; the error is treating unreachable-critical as an emergency that outranks reachable-moderate. The resource being spent isn’t just engineer-hours: it’s attention, change-window risk, and the credibility you’ll need for the next truly urgent night. Triage is priorities under scarcity; Text4Shell is the case that made the industry say it out loud.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.