CVE-2026-33209
Avo has a XSS vulnerability on `return_to` param
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
8th
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
| CWE | CWE-79 |
| Vendor | avo-hq |
| Product | avo |
| Published | Mar 20, 2026 |
| Last Updated | Mar 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for avo-hq avo
Be the first to know when new unknown vulnerabilities affecting avo-hq avo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
avo-hq / avo
< 3.30.3