Read the docs
TI-2023-16949 Aliases CVE-2023-34103GHSA-5cr9-5jx3-2g39

Stored XSS (Cross Site Scripting) in html content based fields of avo

Priority HIGH 67CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed avo (RubyGems): 2.33.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
avo-hqavoup to 2.33.2; 3.0.0.pre1 – 3.0.0.pre12—No fix listedCNA
—avo (RubyGems)before 2.33.32.33.3Patch availableGHSA-5cr9-5jx3-2g39
—avo (RubyGems)3.0.0.pre1 – 3.0.0.pre12—No fix listedGHSA-5cr9-5jx3-2g39
  • avo Vendoravo-hq Affected up to 2.33.2; 3.0.0.pre1 – 3.0.0.pre12 Fixed in — No fix listed CNA
  • avo (RubyGems) Vendor— Affected before 2.33.3 Fixed in 2.33.3 Patch available GHSA-5cr9-5jx3-2g39
  • avo (RubyGems) Vendor— Affected 3.0.0.pre1 – 3.0.0.pre12 Fixed in — No fix listed GHSA-5cr9-5jx3-2g39

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:*up to 2.33.2Vulnerableavo-hq
cpe:2.3:a:avohq:avo:3.0.0:pre12:*:*:*:ruby:*:*3.0.0 pre12Vulnerableavo-hq
  • cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:* Versions up to 2.33.2 Vulnerable ·avo-hq
  • cpe:2.3:a:avohq:avo:3.0.0:pre12:*:*:*:ruby:*:* Versions 3.0.0 pre12 Vulnerable ·avo-hq

Remediation

  • Fix · GHSA-5cr9-5jx3-2g39 avo (RubyGems) Fixed in 2.33.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34103
  2. 2026-10-03 Alias added: GHSA-5cr9-5jx3-2g39

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2023-16948 Possible unsafe reflection / partial denial of service in avo CVSS 3.1HIGH 8.8
  • TI-2024-14784 Stored cross-site scripting (XSS) in `key_value` field in Avo CVSS 3.1HIGH 7.3
  • TI-2024-14985 Cross site scripting in Action messages on Avo CVSS 3.1MEDIUM 6.5
  • TI-2026-25630 Avo has a XSS vulnerability on `return_to` param CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences