What happened
Remote command execution in Apache Commons Text below 1.10 via CVE-2022-42889.
Affected versions
Unknown product: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 52261Apache Commons Text 1.10.0 - Remote Code ExecutionArjun Chaudhary2025-04-18VerifiedSploitusRemote command execution in Apache Commons Text below 1.10 via CVE-2022-42889.KitPloit2026-09-22T10:37:13Candidatekitploit.comRemote command execution in Apache Commons Text below 1.10 via CVE-2022-42889.ru2026-09-22T10:37:13CandidatePoC-in-GitHub · SeanWrightSec/CVE-2022-42889-PoCProof of Concept for the Apache commons-text vulnerability CVE-2022-42889.★ 35SeanWrightSec2022-10-17CandidatePoC-in-GitHub · chainguard-dev/text4shell-policyClusterImagePolicy demo for cve-2022-42889 text4shell★ 4chainguard-dev2022-10-17CandidatePoC-in-GitHub · tulhan/commons-text-goatAn intentionally vulnerable webapp to get your hands dirty with CVE-2022-42889.★ 1tulhan2022-10-18CandidatePoC-in-GitHub · karthikuj/cve-2022-42889-text4shell-dockerDockerized POC for CVE-2022-42889 Text4Shell★ 76karthikuj2022-10-18CandidatePoC-in-GitHub · ClickCyber/cve-2022-42889cve-2022-42889 Text4Shell CVE-2022-42889 affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10.★ 40ClickCyber2022-10-18CandidatePoC-in-GitHub · korteke/CVE-2022-42889-POCA simple application that shows how to exploit the CVE-2022-42889 vulnerability★ 10korteke2022-10-18CandidatePoC-in-GitHub · rockmelodies/CVE-2022-42889CVE-2022-42889 dockerized sample application (Apache Commons Text RCE)★ 0rockmelodies2022-10-19CandidatePoC-in-GitHub · eunomie/cve-2022-42889-check★ 0eunomie2022-10-19CandidatePoC-in-GitHub · kljunowsky/CVE-2022-42889-text4shellApache commons text - CVE-2022-42889 Text4Shell proof of concept exploit.★ 58kljunowsky2022-10-19CandidatePoC-in-GitHub · neerazz/CVE-2022-42889★ 0neerazz2022-10-19CandidatePoC-in-GitHub · kiralab/text4shell-scanA fully automated, accurate, and extensive scanner for finding text4shell RCE CVE-2022-42889★ 0kiralab2022-10-20CandidatePoC-in-GitHub · uk0/cve-2022-42889-intercept通过 jvm 启动参数 以及 jps pid进行拦截非法参数★ 3uk02022-10-20CandidatePoC-in-GitHub · securekomodo/text4shell-pocProof of Concept Appliction for testing CVE-2022-42889★ 8securekomodo2022-10-20CandidatePoC-in-GitHub · humbss/CVE-2022-42889★ 2humbss2022-10-21CandidatePoC-in-GitHub · stavrosgns/Text4ShellPayloadsThis project includes a python script which generates malicious commands leveraging CVE-2022-42889 vulnerability★ 3stavrosgns2022-10-21CandidatePoC-in-GitHub · s3l33/CVE-2022-42889python script for CVE-2022-42889★ 3s3l332022-10-22CandidatePoC-in-GitHub · galoget/CVE-2022-42889-Text4Shell-DockerDockerized PoC for CVE-2022-42889 Text4Shell★ 0galoget2022-10-22CandidatePoC-in-GitHub · rhitikwadhvana/CVE-2022-42889-Text4Shell-Exploit-POCCVE-2022-42889 Text4Shell Exploit POC★ 1rhitikwadhvana2022-10-22CandidatePoC-in-GitHub · akshayithape-devops/CVE-2022-42889-POCA simple dockerize application that shows how to exploit the CVE-2022-42889 vulnerability.★ 5akshayithape-devops2022-10-23CandidatePoC-in-GitHub · 0xmaximus/Apache-Commons-Text-CVE-2022-42889Apache Text4Shell (CVE-2022-42889) Burp Bounty Profile★ 40xmaximus2022-10-23CandidatePoC-in-GitHub · smileostrich/Text4Shell-ScannerVulnerability Scanner for CVE-2022-42889 (Text4Shell)★ 5smileostrich2022-10-23CandidatePoC-in-GitHub · cxzero/CVE-2022-42889-text4shellCVE-2022-42889 aka Text4Shell research & PoC★ 20cxzero2022-10-23CandidatePoC-in-GitHub · Vulnmachines/text4shell-CVE-2022-42889★ 2Vulnmachines2022-10-25CandidatePoC-in-GitHub · Gotcha1G/CVE-2022-42889CVE-2022-42889 Blind-RCE Nuclei Template★ 2Gotcha1G2022-11-02CandidatePoC-in-GitHub · cryxnet/CVE-2022-42889-RCEProof of Concept for CVE-2022-42889 (Text4Shell Vulnerability)★ 15cryxnet2022-11-04CandidatePoC-in-GitHub · sunnyvale-it/CVE-2022-42889-PoCCVE-2022-42889 (a.k.a. Text4Shell) RCE Proof of Concept★ 2sunnyvale-it2022-11-05CandidatePoC-in-GitHub · QAInsights/cve-2022-42889-jmeterScript to handle CVE 2022-42889★ 7QAInsights2022-11-05CandidatePoC-in-GitHub · adarshpv9746/Text4shell--Automated-exploit---CVE-2022-42889★ 0adarshpv97462022-11-07CandidatePoC-in-GitHub · vickyaryan7/Text4shell-exploitPython Script to exploit RCE of CVE-2022-42889★ 5vickyaryan72022-11-21CandidatePoC-in-GitHub · gokul-ramesh/text4shell-exploitCVE-2022-42889 - Text4Shell exploit★ 1gokul-ramesh2022-12-07CandidatePoC-in-GitHub · f0ng/text4shellburpscannertext4shell(CVE-2022-42889) BurpSuite Scanner★ 20f0ng2022-12-09CandidatePoC-in-GitHub · devenes/text4shell-cve-2022-42889Kubernetes Lab for CVE-2022-42889★ 2devenes2023-02-28CandidatePoC-in-GitHub · hotblac/text4shellA demonstration of CVE-2022-42889 (text4shell) remote code execution vulnerability★ 0hotblac2023-03-01CandidatePoC-in-GitHub · necroteddy/CVE-2022-42889docker for CVE-2022-42889★ 0necroteddy2023-04-04CandidatePoC-in-GitHub · ReachabilityOrg/cve-2022-42889-text4shell-docker★ 0ReachabilityOrg2023-04-08CandidatePoC-in-GitHub · Dima2021/cve-2022-42889-text4shell★ 0Dima20212023-04-18CandidatePoC-in-GitHub · aaronm-sysdig/text4shell-dockerDockerized POC for CVE-2022-42889 Text4Shell★ 0aaronm-sysdig2023-05-22CandidatePoC-in-GitHub · alealeluyah/CVE-2022-42889-Text4Shell-POCThis repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889.★ 13alealeluyah2023-06-27CandidatePoC-in-GitHub · Sic4rio/CVE-2022-42889Text4Shell★ 0Sic4rio2023-09-06CandidatePoC-in-GitHub · 34006133/CVE-2022-42889RCE PoC for Apache Commons Text vuln★ 0340061332023-09-09CandidatePoC-in-GitHub · DimaMend/cve-2022-42889-text4shell★ 0DimaMend2023-09-22CandidatePoC-in-GitHub · joshbnewton31080/cve-2022-42889-text4shell★ 0joshbnewton310802024-02-08CandidatePoC-in-GitHub · Syndicate27/text4shell-exploitA custom Python-based proof-of-concept (PoC) exploit targeting Text4Shell (CVE-2022-42889), a critical remote code execution vulnerability in Apache Commons Text versions < 1.10.★ 0Syndicate272025-03-24CandidatePoC-in-GitHub · ifconfig-me/Log4Shell-PayloadsLog4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889★ 8ifconfig-me2025-07-23CandidatePoC-in-GitHub · shoucheng3/asf__commons-text_CVE-2022-42889_1-9★ 0shoucheng32025-08-20CandidatePoC-in-GitHub · Goultarde/CVE-2022-42889-text4shellProof of Concept (PoC) for CVE-2022-42889 (Text4Shell) targeting Apache Commons Text versions prior to 1.10.0. This script automates Remote Code Execution (RCE) via script interpolation to establish a reverse shell. This version is a structured optimization based on the original exploit found at Exploit-DB (ID: 52261).★ 1Goultarde2026-01-02CandidatePoC-in-GitHub · engranaabubakar/CVE-2022-42889★ 0engranaabubakar2026-03-10CandidatePoC-in-GitHub · sangrok-jeon/CVE-2022-42889-AnalysisCVE-2022-42889 취약점 분석보고서★ 0sangrok-jeon2026-03-16CandidatePoC-in-GitHub · KosmicOwl045/ICT287-CVE-2022-42889Setup and exploit recreation for CVE-2022-42889 Text4Shell.★ 0KosmicOwl0452026-03-30CandidatePoC-in-GitHub · Hkaeeeer/CVE-2022-42889exploit for CVE-2022-42889★ 0Hkaeeeer2026-07-15CandidatePoC-in-GitHub · gustanini/CVE-2022-42889-Text4Shell-POC★ 0gustanini2026-09-04CandidateSource timeline
Discovered through Exploit-DBView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.