CVE-2026-41692 — i18nextify is a JavaScript library that adds website

title: CVE-2026-41692 - i18nextify JavaScript Injection via Malicious Translation
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-41692 by observing requests to the i18nextify library that include potentially malicious JavaScript or data URIs in the query parameters. This indicates an attempt to inject arbitrary code into the web page by manipulating translation data.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41692/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/i18nextify'
      cs-uri-query|contains:
          - 'javascript:'
      condition: selection
  selection_2:
      cs-uri|contains:
          - '/i18nextify'
      cs-uri-query|contains:
          - 'data:text/html;base64,'
      condition: selection_2
  selection_3:
      cs-uri|contains:
          - '/i18nextify'
      cs-uri-query|contains:
          - 'data:text/html,<script>'
      condition: selection_3
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse