Read the docs
TI-2026-73631 Aliases CVE-2026-110005GHSA-hxg3-3gpg-5m9c

OS command injection in Komodo lets users run commands as root

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Komodo versions from 1.19.1 before 2.3.0 contain an OS command injection flaw (CWE-78) in the periphery agent's container management. An authenticated user with Execute permission, or Read plus Logs, on a managed server can insert shell metacharacters through a container name processed by DestroyContainer. The name is interpolated without escaping into a command run with sh -c, so the user runs arbitrary commands as root on the managed host without holding the Terminal permission.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02233 82nd percentileScored 2026-11-07
Fix Fixed Komodo (Komodo): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KomodoKomodo1.19.1 to before 2.3.02.3.0Patch availableCNA
  • Komodo VendorKomodo Affected 1.19.1 to before 2.3.0 Fixed in 2.3.0 Patch available CNA

Remediation

Upgrade Komodo to version 2.3.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Komodo (Komodo) Fixed in 2.3.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110005
  2. 2026-10-13 Alias added: GHSA-hxg3-3gpg-5m9c
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-20 CVSS score added · CISA ADP
  6. 2026-10-20 Weakness changed · CISA ADP
  7. 2026-10-20 CISA SSVC decision points changed
  8. 2026-10-20 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2005-04106 Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows… CVSS 2.0MEDIUM 5.8
  • TI-2005-04105 SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences