CVE-2026-33209

Avo has a XSS vulnerability on `return_to` param

Published Mar 20, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.

Analysis

Technical impact

The vulnerability is a reflected cross‑site scripting (CWE‑79) flaw in the return_to query parameter of the Avo administration interface. An attacker can craft a malicious URL containing JavaScript that is executed when a user clicks a navigation button, potentially hijacking sessions, injecting malicious scripts, or delivering further attacks.

Affected Systems

Avo (avo‑hq) is a Ruby on Rails administrative framework used to create panels. Any deployment of Avo prior to version 3.30.3 that processes the return_to parameter is affected. The issue was addressed in release 3.30.3 on the avo‑hq GitHub repository.

Risk and Exploitability

The CVSS v3.1 score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of current exploitation. Avo is not listed in CISA’s KEV catalog. Exploitation requires a victim to click a navigation link after visiting a crafted URL, making it dependent on social engineering and user privilege. If successfully exploited, the attacker can run arbitrary client‑side code and access sensitive information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

avo-hq

avo

affected

Version	Status	Constraints
`< 3.30.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:*

No data.

Vendor Product Versions

Avo Hq

Avo

Version	Status	Scheme	Platform
`[0,3.30.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply version 3.30.3 or later of Avo to eliminate the reflected XSS vulnerability.
If an upgrade is not immediately possible, restrict access to the Avo interface to trusted administrators and disable the return_to functionality.
Monitor incoming URLs for suspicious return_to parameters containing script tags or JavaScript payloads.
Ensure content‑security‑policy headers are configured to limit the execution of injected scripts.

Generated by OpenCVE AI on March 23, 2026 at 21:07 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-762r-27w2-q22j	Avo has a XSS vulnerability on `return_to` param

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.274% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d
https://github.com/avo-hq/avo/pull/4330
https://github.com/avo-hq/avo/releases/tag/v3.30.3
https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j

History

Mar 24, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 23, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Avohq Avohq avo
CPEs		cpe:2.3:a:avohq:avo::::::ruby::*
Vendors & Products		Avohq Avohq avo
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Mar 23, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Avo Hq Avo Hq avo
Vendors & Products		Avo Hq Avo Hq avo

Mar 20, 2026 10:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
Title		Avo has a XSS vulnerability on `return_to` param
Weaknesses		CWE-79
References		https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d https://github.com/avo-hq/avo/pull/4330 https://github.com/avo-hq/avo/releases/tag/v3.30.3 https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`