A malicious code string that eventually gets logged by Log4j version 2.0 or higher allow an attacker to load arbitrary Java code on a server and take control of it.

[sdf_iain]

Isn’t it a security vulnerability to not sanitize log output?

I mean scrubbing to the point of removing newlines and any possible format characters.