Komodo’s periphery agent provides container‑management features in version 2.2.0, and an authenticated low‑privileged user with Execute, or Read plus Logs, permissions on a managed server can supply shell metacharacters in a container name. The API methods DestroyContainer and SearchContainerLog interpolate the name into a command invoked via sh -c without proper escaping. This allows the attacker to inject arbitrary shell commands that are executed as root on the managed host, effectively bypassing the need for the higher‑level Terminal permission and giving the user unrestricted host‑level execution.

The vulnerability impacts Komodo version 2.2.0. No other product versions are currently listed as affected.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of 2% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV database. Nevertheless, the flaw permits arbitrary command execution as root on the host. Successful exploitation requires the attacker to be authenticated with Execute or Read+Logs permissions on a managed server, but once those are in place it allows a user without Terminal permission to control the managed system.