Text4Shell
CVE-2022-42889 — RCE in Apache Commons Text via script interpolation. ${script:javascript:...} triggers Nashorn JS engine + system calls.
Disclosed October 2022. Named "Text4Shell" out of habit after Log4Shell + Spring4Shell. Less catastrophic — Commons Text is less ubiquitous than Log4j, and interpolation is rarely fed untrusted input. Patched in 1.10.0.