{"id":"CVE-2026-105987","kind":"vulnerability","aliases":["CVE-2026-105987"],"related":[],"title":"KGS tia Viewer: stored XSS via annotation API runs script in browsers","description":"KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session.\nThis issue has been fixed in version 1.2.8.","summary":"KGS Software's tia Viewer does not validate input sent to its annotation API, so a logged-in attacker can store JavaScript inside a sticky-note annotation. When another user opens that document, the browser runs the script and the attacker can hijack that user's session.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-viewer","kgs-software","other","tia-viewer"],"not_affected_if":["patched-1.2.8-or-later"],"how_to_check":"- Check the installed tia Viewer version and compare it with `1.2.8`\n- Confirm whether the annotation API is reachable by users outside your trusted group, which the sources do not say: unknown","fix":"- Upgrade tia Viewer to `1.2.8` or later\n- Until upgraded, restrict who can create annotations: unknown","status":"open","published_at":"2026-10-27T15:16:31+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","triaged_at":"2026-10-27T15:33:32+00:00","updated_at":"2026-10-27T15:33:32+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T15:33:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade tia Viewer to `1.2.8` or later\n- Until upgraded, restrict who can create annotations: unknown","reach":"network","title":"KGS tia Viewer: stored XSS via annotation API runs script in browsers","impact":"medium","summary":"KGS Software's tia Viewer does not validate input sent to its annotation API, so a logged-in attacker can store JavaScript inside a sticky-note annotation. When another user opens that document, the browser runs the script and the attacker can hijack that user's session.","category":"other","nicknames":[],"who_cares":["kgs-software","tia-viewer","document-viewer"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs script in victim's browser and takes over their session","analyst_note":"Check the NVD entry and KGS Software advisory for affected version range and whether the annotation API is exposed by default.","how_to_check":"- Check the installed tia Viewer version and compare it with `1.2.8`\n- Confirm whether the annotation API is reachable by users outside your trusted group, which the sources do not say: unknown","needs_analyst":true,"not_affected_if":["patched-1.2.8-or-later"],"who_is_affected":"Teams that run KGS Software tia Viewer and let more than one user create or view annotated documents. The sources do not describe the exact deployment conditions beyond the need for an authenticated account to store the payload. Installations on a version at or above 1.2.8 are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3344,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105987':15A,18A '-2026':14A,17A '1.2.8':143C 'annot':7A,41B,57B,89C,109C,120C 'anoth':59B 'api':8A,42B,90C 'arbitrari':103C 'attack':48B,71B,100C 'authent':99C 'browser':12A,65B,123C 'compromis':131C 'cve':13A,16A 'document':20B,63B,115C 'document-view':19B 'due':91C 'execut':124C 'fix':140C 'hijack':73B 'inject':102C 'input':37B,96C 'insid':52B 'issu':137C 'javascript':51B,104C 'kgs':1A,23B,29B,78C 'kgs-softwar':22B 'lack':94C 'lead':129C 'log':46B 'logged-in':45B 'may':128C 'note':56B 'open':61B,113C 'payload':105C,126C 'render':118C 'run':9A,66B 'script':10A,68B 'sent':38B 'session':77B,135C 'softwar':24B,30B,79C 'sticki':55B 'sticky-not':54B 'stickynot':108C 'store':4A,50B,85C 'tia':2A,27B,32B,80C 'tia-view':26B 'user':60B,75B,112C,133C 'valid':36B,97C 'version':142C 'via':6A,87C 'viewer':3A,21B,28B,33B,81C,117C 'vulner':83C 'xss':5A,86C","nicknames":[],"mitigations":[],"who_affected":"Teams that run KGS Software tia Viewer and let more than one user create or view annotated documents. The sources do not describe the exact deployment conditions beyond the need for an authenticated account to store the payload. Installations on a version at or above 1.2.8 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105987","severity":null,"published_at":"2026-10-27T15:16:31+00:00","modified_at":"2026-10-27T15:16:31+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","fetched_at":"2026-10-27T15:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}