Answer in brief
CVE-2026-105987 records a Medium severity (CVSS 5.1) vulnerability in Stored XSS in KGS Software tia Viewer. The current sources do not mark it as known exploited. The current feed maps KGS Software/tia Viewer (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps KGS Software/tia Viewer (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| KGS Software/tia Viewergeneric | >=0 <1.2.8 | 1.2.8 |
Published upstream
Oct 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 27, 2026
KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.
Quoted source text, attributed separately from HOL analysis.