What’s Vulnerable › Vulnerabilities

CVE-2024-22411: Cross site scripting in Action messages on Avo

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-79

Description

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.

Affected products

• avo-hq avo: before 2.47.0; from 3.0.2 before 3.3.0; 3.0.0-pre12 — fixed in 2.47.0, 3.3.0

How to fix

Upgrade to a fixed version: avo-hq avo 2.47.0, 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258
• https://github.com/avo-hq/avo/releases/tag/v2.47.0
• https://github.com/avo-hq/avo/releases/tag/v3.3.0
• https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh
• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258
• https://github.com/avo-hq/avo/releases/tag/v2.47.0
• https://github.com/avo-hq/avo/releases/tag/v3.3.0
• https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh

Get alerted when CVE-2024-22411 or the next vulnerability affects your stack