tia Viewer CVE-2026-105987

Exploitation requires an authenticated account (PR:L) with access to tia Viewer's annotation API and the ability to create or edit a stickynote annotation, into which arbitrary JavaScript is injected because the API lacks input validation. Execution additionally requires a second user to subsequently open the document (UI:P / passive interaction), at which point the viewer renders the stored annotation and the browser runs the payload. Limiting factors: the attacker must already be authenticated, the payload only fires when a victim opens the affected document, and impact is confined to the victim's browser session (no server-side confidentiality/integrity/availability impact per the vector). Versions 1.2.8 and later are not affected.

This is a genuinely moderate-severity, lower-priority issue rather than an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) indicates network-reachable, low-complexity exploitation but requires authentication (PR:L) and passive victim interaction (UI:P), with impact limited to the subsequent system (the victim's browser session: SC:L/SI:L) and no direct impact to the vulnerable application itself (VC:N/VI:N/VA:N). No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or probable exploitation. The vuln.today decision label is 'this_month', consistent with a stored XSS that needs an authenticated foothold and a victim action rather than a wormable or unauthenticated flaw. No SSVC fields (exploitation/automatable/technical impact) were supplied to cross-reference. The signals are internally consistent - a modest-impact, authentication-gated client-side flaw - so this should be patched on a routine cycle, not treated as a drop-everything priority.

An authenticated user with permission to add annotations uses the annotation API to save a stickynote containing a malicious JavaScript payload instead of normal note text. When a colleague later opens that document in tia Viewer, the viewer renders the annotation and the browser executes the injected script in the victim's session, allowing session theft or actions as the victim. No public exploit code was identified in the provided data; exploitation requires authentication and a victim opening the poisoned document.