Omega-PSIR XSS flaw patched in 4.6.7
A reflected XSS vulnerability in Omega-PSIR's lang parameter allows attackers to execute arbitrary JavaScript via malicious URLs; fixed in version 4.6.7.
CERT Polska disclosed CVE-2026-1434, a reflected cross-site scripting vulnerability in Omega-PSIR software. The flaw resides in the lang parameter and allows attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when opened. The vulnerability was responsibly reported by Łukasz Rybak and addressed through coordinated disclosure.
The issue has been remediated in Omega-PSIR version 4.6.7. Organizations running affected versions should upgrade promptly to eliminate this attack vector. While XSS vulnerabilities are commonly exploited for session hijacking and credential theft, there is no indication of active exploitation at the time of disclosure.
Mentioned in this report
Detection guidance
Reflected XSS Attempt via lang Parameter (Omega-PSIR CVE-2026-1434)
Detects HTTP requests containing script/javascript injection patterns in the lang query parameter, consistent with exploitation attempts of the Omega-PSIR reflected XSS vulnerability (CVE-2026-1434). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt via lang Parameter
id: da720585-1e92-5c7d-8769-6da2682a4b9f
status: experimental
description: 'Detects web requests where the ''lang'' query parameter contains script
tags, javascript: URIs, or event-handler style payloads, matching the pattern of
the Omega-PSIR reflected XSS vulnerability (CVE-2026-1434). No active exploitation
was confirmed at disclosure time; this rule is intended to catch scanning or exploitation
attempts against unpatched instances.
'
references:
- CVE-2026-1434
author: Vorant
tags:
- attack.t1189
- attack.t1059.007
logsource:
category: proxy
product: null
detection:
selection:
c-uri|contains: lang=
xss_pattern:
c-uri|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- alert(
filter:
c-uri|contains:
- lang=en
- lang=pl
- lang=de
- lang=fr
- lang=es
condition: selection and xss_pattern and not filter
falsepositives:
- Legitimate locale codes accidentally matching filter list additions for uncommon
languages
- Automated vulnerability scanners or bug bounty testing traffic
- Web application firewall or security researcher validation requests
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1434
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free