This was patched by mojang and forge.
Download the LATEST version of forge for a fix.
Latest forge: https://files.minecraftforge.net/net/minecraftforge/forge/index_1.12.2.html
Mojang article: https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition
Fixes the Log4j RCE exploit
I wrote this patch quickly, and it's kind of stupid (but it works)
all it does is remove the code that logs server chat messages to console
(1.12.2 forge mod)