Read the docs
TI-2024-14784 Aliases CVE-2024-22191GHSA-ghjv-mh6x-7q6h

Stored cross-site scripting (XSS) in `key_value` field in Avo

Priority HIGH 65CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00745 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed avo (avo-hq): 3.2.4, 2.47.0avo (RubyGems): 3.2.4, 2.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
avo-hqavo3.0.0.beta1 to before 3.2.4; before 2.47.03.2.4, 2.47.0Patch availableCNA
—avo (RubyGems)3.0.0.beta1 to before 3.2.43.2.4Patch availableGHSA-ghjv-mh6x-7q6h
—avo (RubyGems)before 2.47.02.47.0Patch availableGHSA-ghjv-mh6x-7q6h
  • avo Vendoravo-hq Affected 3.0.0.beta1 to before 3.2.4; before 2.47.0 Fixed in 3.2.4, 2.47.0 Patch available CNA
  • avo (RubyGems) Vendor— Affected 3.0.0.beta1 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-ghjv-mh6x-7q6h
  • avo (RubyGems) Vendor— Affected before 2.47.0 Fixed in 2.47.0 Patch available GHSA-ghjv-mh6x-7q6h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:*before 2.47.0; 3.0.0 to before 3.3.0Vulnerableavo-hq
  • cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:* Versions before 2.47.0; 3.0.0 to before 3.3.0 Vulnerable ·avo-hq

Remediation

  • Fix · CNA avo (avo-hq) Fixed in 3.2.4, 2.47.0
  • Fix · GHSA-ghjv-mh6x-7q6h avo (RubyGems) Fixed in 3.2.4 Advisory →
  • Fix · GHSA-ghjv-mh6x-7q6h avo (RubyGems) Fixed in 2.47.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22191
  2. 2026-10-03 Alias added: GHSA-ghjv-mh6x-7q6h

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2023-16948 Possible unsafe reflection / partial denial of service in avo CVSS 3.1HIGH 8.8
  • TI-2023-16949 Stored XSS (Cross Site Scripting) in html content based fields of avo CVSS 3.1HIGH 7.3
  • TI-2024-14985 Cross site scripting in Action messages on Avo CVSS 3.1MEDIUM 6.5
  • TI-2026-25630 Avo has a XSS vulnerability on `return_to` param CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences