[alblue]

It's also not specific to Commons Collections - the same escape is available through Spring and Groovy as well.

http://www.infoq.com/news/2015/11/commons-exploit