Host
Monthly
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to execute arbitrary OS commands as the current user by sending a crafted URL through the out-of-session chat feature. The attack exploits CWE-78 (OS Command Injection) in the Linux URL-handling path and requires only that the victim click the malicious link - no attacker authentication is needed. No public exploit has been identified at time of analysis; the vendor has released a patch in version 15.81.5 per advisory TV-2026-1009.