The "periphery" agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with "Execute", or "Read" plus "Logs", permission on a managed server can supply shell metacharacters in a container name processed by the "DestroyContainer" or "SearchContainerLog" operations. The container name is interpolated without escaping into a command executed using "sh -c", allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's "Terminal" permission to obtain unrestricted host-level command execution.