Junglewise Threat Intelligence

CVE-2026-33209: Avo has a XSS vulnerability on `return_to` param

CVE-2026-33209 · Severity: medium · CVSS 4 · Published 2026-03-18

Technologies: avo (RubyGems). Vendors: RubyGems.

Executive brief

Avo has a XSS vulnerability on `return_to` param

Affected products

RubyGems avo

Related threats

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment uplo
Avo broken access control in ActionsController