KGS Software tia Viewer Stored XSS Fixed
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
A stored XSS flaw in KGS Software tia Viewer lets an authenticated attacker hijack user sessions via malicious annotations; patched in version 1.2.8.
CERT Polska coordinated disclosure of CVE-2026-105987, a stored cross-site scripting vulnerability in KGS Software's tia Viewer affecting all versions prior to 1.2.8. The flaw stems from improper input validation in the annotation API, allowing an authenticated attacker to inject arbitrary JavaScript into a stickynote annotation within a document. When another user subsequently opens the document, the viewer renders the malicious annotation and the browser executes the payload, potentially compromising that user's session.
The vulnerability requires the attacker to have authenticated access to inject the payload, limiting the attack to insiders or users with legitimate access who abuse annotation functionality to target other users of shared documents. There is no indication of active exploitation in the wild; this is a responsibly disclosed vulnerability reported by researcher Dawid Dudek (4c1d8urn) through CERT Polska's coordinated vulnerability disclosure process. The vendor has released version 1.2.8 to remediate the issue.
Defenders using KGS Software tia Viewer should upgrade to version 1.2.8 or later as soon as possible. Organizations should audit who has authenticated access to annotation features and review any session anomalies tied to document viewing workflows, particularly in environments where documents are shared across users with varying trust levels.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-105987
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,337 reports from 144 sources, 610 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs