avo Known Vulnerabilities & Fixes
avo has 8 known security vulnerabilities in RubyGems (Ruby). Upgrade to version 4.0.0.beta.51 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 4.0.0.beta.51
Upgrading to 4.0.0.beta.51 or later resolves all 8 known vulnerabilities in avo. Run: gem install avo -v 4.0.0.beta.51
Is avo in your project?
Check if you're affected and upgrade to 4.0.0.beta.51 to stay secure.
Security Summary
- 13 affected version ranges have been identified across these 8 advisories.
- 100% of known issues have a published fixed version.
- Remediation: gem update avo
Vulnerabilities
8 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Jun 6, 2023, most recently Jul 9, 2026 (1129 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation | CRITICAL | 0.2.0, 0.2.1, 0.2.2, 0.2.3 (+617 more) | 3.32.1, 4.0.0.beta.51 |
| CVE-2026-42205 Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources | HIGH | 0.2.0, 0.2.1, 0.2.2, 0.2.3 (+565 more) | 3.31.2 |
| CVE-2023-34102 avo possible unsafe reflection / partial DoS vulnerability | HIGH | 0.2.0, 0.2.1, 0.2.2, 0.2.3 (+324 more) | 2.33.3 |
| CVE-2024-22191 avo vulnerable to stored cross-site scripting (XSS) in key_value field | HIGH | 3.0.0.beta1, 3.0.0.pre1, 3.0.0.pre10, 3.0.0.pre11 (+404 more) | 3.2.4, 2.47.0 |
| CVE-2023-34103 avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields | HIGH | 0.2.0, 0.2.1, 0.2.2, 0.2.3 (+324 more) | 2.33.3 |
| CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy | MEDIUM | 2.28.0, 2.28.1.pre.pr1642, 2.28.2.pre.pr1642, 2.28.3.pre.pr1646 (+277 more) | 3.32.0 |
| CVE-2026-33209 Avo has a XSS vulnerability on `return_to` param | MEDIUM | 0.2.0, 0.2.1, 0.2.2, 0.2.3 (+561 more) | 3.30.3 |
| CVE-2024-22411 Cross-site scripting (XSS) in Action messages on Avo | MEDIUM | 3.0.0.beta1, 3.0.0.pre1, 3.0.0.pre10, 3.0.0.pre11 (+404 more) | 3.3.0, 2.47.0 |
About This Data
Vulnerability data for avo is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related RubyGems (Ruby) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of avo.