CVE-2026-33209: Avohq Avo

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.

Affected products

• Avohq Avo: before 3.30.3 (fixed in 3.30.3)

Published 2026-03-20. Last modified 2026-06-17.