Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
RubySec ➜ CVE-2026-33209 (avo): Avo has a XSS vulnerability on `return_to` param https://rubysec.com/advisories/CVE-2026-33209/
Post summary
The advisory announces an XSS flaw in Avo’s `return_to` parameter, but provides no PoC, exploit code, or patch detail.
CVE-2026-33209 Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_t… https://www.cve.org/CVERecord?id=CVE-2026-33209
Post summary
The post announces a reflected XSS in Avo (Ruby on Rails admin panel framework) affecting versions before 3.30.3.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | avohq | avo | - | ruby | - |