{"id":"CVE-2026-110005","summary":"Moghtech Komodo contains an OS command injection vulnerability","details":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.","modified":"2026-10-15T02:47:27.774147197Z","published":"2026-10-13T19:23:52.191Z","database_specific":{"cna_assigner":"certcc","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110005.json"},"references":[{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/456950"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110005.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110005"},{"type":"PACKAGE","url":"https://github.com/moghtech/komodo"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moghtech/komodo","events":[{"introduced":"e732da3b0513f37d5fefbd0803aa1bfc308c9571"},{"fixed":"97efa4808a96a41eba38fa469eec6262639d8866"}],"database_specific":{"extracted_events":[{"introduced":"1.19.1"},{"fixed":"2.3.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.1.2","v2.1.1","v2.1.0","v2.0.0","v2.0.0-dev-35","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110005.json"}}],"schema_version":"1.9.0"}