Apache Commons Text Remote Code Execution Vulnerability

Apache Commons Text (versions 1.5–1.9) contains a critical remote code execution vulnerability (CVE-2022-42889, aka Text4Shell/Act4Shell) in the StringSubstitutor interpolator that permits attacker-supplied lookups (e.g., script, dns, url) to execute arbitrary code; a public PoC demonstrates command execution, the vendor recommends upgrading to 1.10.0 (which disables the dangerous interpolators), and Zscaler has deployed protections to detect exploitation.