TeamPlus Messenger contains a a remote attacker supply a malicious script through a crafted link. If the victim opens the link and accepts a Windows security warning, the injected JavaScript runs with the privileges of the user, allowing the attacker to execute any code on that machine. The vulnerability is a classic code injection weakness (CWE‑94).

TeamPlus Technology’s TeamPlus Messenger is the affected product. Users of any version prior to 17.0.7 are vulnerable; upgrades to 17.0.7 or later include the fix.

The CVSS score of 8.6 marks this as high severity, but the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog. Attackers would need to convince an unauthenticated user to click a malicious link and accept a warning; no remote code execution is possible without user interaction. In environments where users are expected to click links, the risk is significant.