github.com
https://github.com/avo-hq/avo CVE-2026-33209
MEDIUM
Avo has a XSS vulnerability on `return_to` param
Record summary
CVE-2026-33209 has a selected CVSS score of 5.3 (medium).
Description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 24, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 3.30.3 | affected | |
| GitHub Advisory | Before 3.30.3 · Fixed in 3.30.3 | affected |
References
7github.com
https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d github.com
https://github.com/avo-hq/avo/pull/4330 github.com
https://github.com/avo-hq/avo/releases/tag/v3.30.3 github.comConfirmation
https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-33209.yml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-33209