Read the docs
TI-2024-14985 Aliases CVE-2024-22411GHSA-g8vp-2v5p-9qfh

Cross site scripting in Action messages on Avo

Priority MEDIUM 62CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed avo (avo-hq): 3.3.0, 2.47.0avo (RubyGems): 3.3.0, 2.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
avo-hqavo3.0.0.beta1 to before 3.3.0; before 2.47.03.3.0, 2.47.0Patch availableCNA
—avo (RubyGems)3.0.0.beta1 to before 3.3.03.3.0Patch availableGHSA-g8vp-2v5p-9qfh
—avo (RubyGems)before 2.47.02.47.0Patch availableGHSA-g8vp-2v5p-9qfh
  • avo Vendoravo-hq Affected 3.0.0.beta1 to before 3.3.0; before 2.47.0 Fixed in 3.3.0, 2.47.0 Patch available CNA
  • avo (RubyGems) Vendor— Affected 3.0.0.beta1 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-g8vp-2v5p-9qfh
  • avo (RubyGems) Vendor— Affected before 2.47.0 Fixed in 2.47.0 Patch available GHSA-g8vp-2v5p-9qfh

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:*before 2.47.0; 3.0.2 to before 3.3.0Vulnerableavo-hq
cpe:2.3:a:avohq:avo:3.0.0:pre12:*:*:*:ruby:*:*3.0.0 pre12Vulnerableavo-hq
  • cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:* Versions before 2.47.0; 3.0.2 to before 3.3.0 Vulnerable ·avo-hq
  • cpe:2.3:a:avohq:avo:3.0.0:pre12:*:*:*:ruby:*:* Versions 3.0.0 pre12 Vulnerable ·avo-hq

Remediation

  • Fix · CNA avo (avo-hq) Fixed in 3.3.0, 2.47.0
  • Fix · GHSA-g8vp-2v5p-9qfh avo (RubyGems) Fixed in 3.3.0 Advisory →
  • Fix · GHSA-g8vp-2v5p-9qfh avo (RubyGems) Fixed in 2.47.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22411
  2. 2026-10-03 Alias added: GHSA-g8vp-2v5p-9qfh

References

Exploit 1

Patch 2

Advisory 1

Other 4

  • TI-2023-16948 Possible unsafe reflection / partial denial of service in avo CVSS 3.1HIGH 8.8
  • TI-2023-16949 Stored XSS (Cross Site Scripting) in html content based fields of avo CVSS 3.1HIGH 7.3
  • TI-2024-14784 Stored cross-site scripting (XSS) in `key_value` field in Avo CVSS 3.1HIGH 7.3
  • TI-2026-25630 Avo has a XSS vulnerability on `return_to` param CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences