** DISPUTED ** CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI related to \received URLs in the message window.\ NOTE: this issue has been disputed due to the user-assisted nature since the URL must be selected and launched by the victim.