Search for packages
| purl | pkg:gem/avo@3.3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-frm8-sacg-vyaz
Aliases: CVE-2024-22411 GHSA-g8vp-2v5p-9qfh |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12 any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.0.0 release of Avo. Users are advised to upgrade. | There are no reported fixed by versions. |
|
VCID-ym72-wgcj-1kex
Aliases: CVE-2026-33209 GHSA-762r-27w2-q22j |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-frm8-sacg-vyaz | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12 any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.0.0 release of Avo. Users are advised to upgrade. |
CVE-2024-22411
GHSA-g8vp-2v5p-9qfh |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-05-31T10:46:31.479182+00:00 | GithubOSV Importer | Fixing | VCID-frm8-sacg-vyaz | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-g8vp-2v5p-9qfh/GHSA-g8vp-2v5p-9qfh.json | 38.6.0 |
| 2026-05-31T10:20:53.903206+00:00 | Ruby Importer | Affected by | VCID-ym72-wgcj-1kex | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-33209.yml | 38.6.0 |
| 2026-05-31T10:19:17.460662+00:00 | Ruby Importer | Affected by | VCID-frm8-sacg-vyaz | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22411.yml | 38.6.0 |
| 2026-05-31T10:19:16.947862+00:00 | Ruby Importer | Fixing | VCID-frm8-sacg-vyaz | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22411.yml | 38.6.0 |
| 2026-05-31T01:01:49.438631+00:00 | GHSA Importer | Fixing | VCID-frm8-sacg-vyaz | https://github.com/advisories/GHSA-g8vp-2v5p-9qfh | 38.6.0 |