# Omega-PSIR XSS flaw patched in 4.6.7

Published: 2026-02-26 · Severity: medium
Canonical: https://vorant.io/reports/5f316dc5-ffb8-54e7-bb4f-7e02add81579/omega-psir-xss-flaw-patched-in-4-6-7

> A reflected XSS vulnerability in Omega-PSIR's lang parameter allows attackers to execute arbitrary JavaScript via malicious URLs; fixed in version 4.6.7.

CERT Polska disclosed CVE-2026-1434, a reflected cross-site scripting vulnerability in Omega-PSIR software. The flaw resides in the lang parameter and allows attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when opened. The vulnerability was responsibly reported by Łukasz Rybak and addressed through coordinated disclosure.

The issue has been remediated in Omega-PSIR version 4.6.7. Organizations running affected versions should upgrade promptly to eliminate this attack vector. While XSS vulnerabilities are commonly exploited for session hijacking and credential theft, there is no indication of active exploitation at the time of disclosure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-1434

## Detection guidance (public sample)

### Reflected XSS Attempt via lang Parameter (Omega-PSIR CVE-2026-1434)

ATT&CK: T1189

Detects HTTP requests containing script/javascript injection patterns in the lang query parameter, consistent with exploitation attempts of the Omega-PSIR reflected XSS vulnerability (CVE-2026-1434). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Attempt via lang Parameter
id: da720585-1e92-5c7d-8769-6da2682a4b9f
status: experimental
description: 'Detects web requests where the ''lang'' query parameter contains script
  tags, javascript: URIs, or event-handler style payloads, matching the pattern of
  the Omega-PSIR reflected XSS vulnerability (CVE-2026-1434). No active exploitation
  was confirmed at disclosure time; this rule is intended to catch scanning or exploitation
  attempts against unpatched instances.

  '
references:
- CVE-2026-1434
author: Vorant
tags:
- attack.t1189
- attack.t1059.007
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains: lang=
  xss_pattern:
    c-uri|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - '%3Cscript'
    - alert(
  filter:
    c-uri|contains:
    - lang=en
    - lang=pl
    - lang=de
    - lang=fr
    - lang=es
  condition: selection and xss_pattern and not filter
falsepositives:
- Legitimate locale codes accidentally matching filter list additions for uncommon
  languages
- Automated vulnerability scanners or bug bounty testing traffic
- Web application firewall or security researcher validation requests
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1434

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5f316dc5-ffb8-54e7-bb4f-7e02add81579/omega-psir-xss-flaw-patched-in-4-6-7.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup