---
id: "CVE-2026-105987"
kind: "vulnerability"
aliases: ["CVE-2026-105987"]
title: "KGS tia Viewer: stored XSS via annotation API runs script in browsers"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["document-viewer", "kgs-software", "other", "tia-viewer"]
not_affected_if: ["patched-1.2.8-or-later"]
published_at: "2026-10-27T15:16:31+00:00"
first_seen_at: "2026-10-27T15:32:58+00:00"
updated_at: "2026-10-27T15:33:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105987", "first_seen_at": "2026-10-27T15:32:58+00:00"}]
---

# KGS tia Viewer: stored XSS via annotation API runs script in browsers

KGS Software's tia Viewer does not validate input sent to its annotation API, so a logged-in attacker can store JavaScript inside a sticky-note annotation. When another user opens that document, the browser runs the script and the attacker can hijack that user's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed tia Viewer version and compare it with `1.2.8`
- Confirm whether the annotation API is reachable by users outside your trusted group, which the sources do not say: unknown

## Fix

- Upgrade tia Viewer to `1.2.8` or later
- Until upgraded, restrict who can create annotations: unknown

## Timeline

- 2026-10-27T15:32:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105987

## From the sources

KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session.
This issue has been fixed in version 1.2.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_