Loading...
Skip to main content
GeekWala

CVE-2024-22411 — Cross-site scripting (XSS) in avo — CVE Details

MEDIUM

Cross-site scripting (XSS) in Action messages on Avo

Published January 17, 2024Updated September 10, 2026Source: osv

Summary

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.

Advisory Timeline

  • First published January 17, 2024 (998 days ago).
  • Last revised September 10, 2026 — 966 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update avo to 2.47.0 or later
gem install avo -v 2.47.0
Bundler
Update avo to 3.3.0 or later
gem install avo -v 3.3.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
avo
rubygems
0.2.0, 0.2.1, 0.2.2, 0.2.3 (+341 more)2.47.0
avo
rubygems
3.0.0.beta1, 3.0.0.pre1, 3.0.0.pre10, 3.0.0.pre11 (+59 more)3.3.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-79
    Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References

Frequently Asked Questions

What is CVE-2024-22411?
Cross-site scripting (XSS) in Action messages on Avo This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2024-22411?
CVE-2024-22411 affects avo. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-22411 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-g8vp-2v5p-9qfh

Related CVEs

  • CVE-2026-55518
    CRITICAL

    Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

  • CVE-2023-34103
    HIGH

    avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

  • CVE-2023-34102
    HIGH

    avo possible unsafe reflection / partial DoS vulnerability

  • CVE-2024-22191
    HIGH

    avo vulnerable to stored cross-site scripting (XSS) in key_value field

  • CVE-2026-42205
    HIGH

    Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

  • CVE-2026-33209
    MEDIUM

    Avo has a XSS vulnerability on `return_to` param

  • CVE-2026-107399
    MEDIUM

    Mechanize sends credential headers to another origin after a meta refresh

  • CVE-2026-53769
    MEDIUM

    Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies