CVE-2026-33209
Received Received - Intake
Reflected XSS in Avo Framework's return_to Parameter

Publication date: 2026-03-20

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33209
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
avohq avo to 3.30.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in the Avo framework for Ruby on Rails applications, specifically in the return_to query parameter used in the Avo interface.

An attacker can create a malicious URL that injects arbitrary JavaScript code. When a user clicks a dynamically generated navigation button that uses this parameter, the injected script is executed in the user's browser.

This vulnerability was present in versions prior to 3.30.3 and has been fixed in version 3.30.3.

Impact Analysis

This reflected XSS vulnerability can allow attackers to execute arbitrary JavaScript in the context of the affected application.

  • Steal sensitive information such as cookies or session tokens.
  • Perform actions on behalf of the user without their consent.
  • Redirect users to malicious websites.
  • Potentially compromise the security and integrity of the application and its users.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Avo framework to version 3.30.3 or later, where the reflected cross-site scripting (XSS) issue in the return_to query parameter has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart