Update to newer version of arara with newer log4j. Severity is low because exploiting this locally would be challenging.