The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by the DestroyContainer or SearchContainerLog operations. The container name is interpolated without escaping into a command executed using sh -c, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's Terminal permission to obtain unrestricted host-level command execution.