A flaw was found in the community.proxmox Ansible collection's
proxmox_pct_remote connection plugin (plugins/connection/
proxmox_pct_remote.py). The _build_pct_command() method constructs
the pct exec command by joining command arguments with spaces:
  cmd = ["/usr/sbin/pct", "exec", str(vmid), "--", cmd]
  return " ".join(cmd)
This string is passed to Paramiko's chan.exec_command(), which
executes it through the Proxmox host's shell. Shell metacharacters
in the Ansible task's command (>, <, |, ;, &&, $()) are interpreted
by the host shell as root instead of being passed to pct exec for
execution inside the target LXC container. For example, a task
"echo test > /tmp/file" results in the redirect creating the file
on the host rather than inside the container. The reporter
discovered this in production when an ansible.builtin.raw task
writing /etc/resolv.conf silently overwrote the Proxmox host's
resolver. The plugin's put_file and fetch_file methods correctly
use self._shell.quote() to wrap inner commands — the fix is to
apply the same pattern to the exec path. A deprecated copy of
this plugin also exists in community.general since version 10.3.0.
shlex is never imported in the plugin.

    Upstream: https://github.com/ansible-collections/community.proxmox
    Affected code: plugins/connection/proxmox_pct_remote.py
    Affected version: all versions containing proxmox_pct_remote
    Also in: community.general >= 10.3.0 (deprecated copy)
    Fixed version: (pending — reporter provides 1-line fix)
    Reporter: Jake Badoino (jake.badoino)