In other news: If I can intercept the log messages (unencrypted remote syslog, or log file public accessible, log messages also shown to the user) I can still just inject stuff like "${env:DATABASE_PASSWORD:-xxx}". Lots of people are only focusing on the aspect how this can be abused to inject arbitrary code, while it is actually a similar class like SQL injections: Blindly trusting user input instead of doing proper sanitization.
(The whole discussion why a logging mechanism should support the whole JDNI stuff is still perfectly valid).
(The whole discussion why a logging mechanism should support the whole JDNI stuff is still perfectly valid).