Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-27229.json"