Medium severity6.1NVD Advisory· Published Mar 20, 2026· Updated Jun 17, 2026
CVE-2026-33209
CVE-2026-33209
Description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
avoRubyGems | < 3.30.3 | 3.30.3 |
Affected products
3Patches
Vulnerability mechanics
References
7- github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7dnvdPatchWEB
- github.com/avo-hq/avo/pull/4330nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-762r-27w2-q22jghsaADVISORY
- github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22jnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-33209ghsaADVISORY
- github.com/avo-hq/avo/releases/tag/v3.30.3nvdProductRelease NotesWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-33209.ymlghsaWEB
News mentions
0No linked articles in our index yet.