The vulnerability is a reflected cross‑site scripting (CWE‑79) flaw in the return_to query parameter of the Avo administration interface. An attacker can craft a malicious URL containing JavaScript that is executed when a user clicks a navigation button, potentially hijacking sessions, injecting malicious scripts, or delivering further attacks.

Avo (avo‑hq) is a Ruby on Rails administrative framework used to create panels. Any deployment of Avo prior to version 3.30.3 that processes the return_to parameter is affected. The issue was addressed in release 3.30.3 on the avo‑hq GitHub repository.

The CVSS v3.1 score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of current exploitation. Avo is not listed in CISA’s KEV catalog. Exploitation requires a victim to click a navigation link after visiting a crafted URL, making it dependent on social engineering and user privilege. If successfully exploited, the attacker can run arbitrary client‑side code and access sensitive information.