CVE-2021-34419: HTML injection in Zoom Linux client

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-11 · updated 2026-06-17
Weakness: CWE-74

Description

In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks.

Affected products

Zoom Video Communications Inc Zoom Client for Meetings for Windows: before 5.1.0 — fixed in 5.1.0

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom Client for Meetings for Windows 5.1.0. Check the vendor advisory for mitigations.

References

https://explore.zoom.us/en/trust/security/security-bulletin
https://explore.zoom.us/en/trust/security/security-bulletin

Get alerted when CVE-2021-34419 or the next vulnerability affects your stack