avo

The Essential Toolkit for building Internal Tools and admin panels with Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 5d ago
Total releases: 681
Cadence: ~daily
Last 12 months: 131

Reach

Downloads: 3.2M
Stars: 1.8k

Details

License: LGPL-3.0 OR custom
First release: Oct 15, 2020

Releases

Version	Released
`4.2.3` patch	Sep 09, 2026
`4.2.2` patch	Sep 09, 2026
`4.2.1` patch	Sep 05, 2026
`4.2.0` minor	Sep 01, 2026
`4.1.16` patch	Aug 31, 2026
`4.1.15` patch	Aug 20, 2026
`4.1.14` patch	Aug 20, 2026
`4.1.13` patch	Aug 20, 2026
`4.1.12` patch	Aug 18, 2026
`4.1.11` patch	Aug 17, 2026
`4.1.10` patch	Aug 14, 2026
`4.1.9` patch	Aug 13, 2026
`4.1.8` patch	Aug 13, 2026
`4.1.7` patch	Aug 13, 2026
`3.32.4` patch	Aug 13, 2026
`3.32.3` patch	Aug 12, 2026
`4.1.6` patch	Aug 10, 2026
`4.1.5` patch	Aug 10, 2026
`4.1.4` patch	Aug 10, 2026
`3.32.2` patch	Aug 10, 2026
`4.1.3` patch	Aug 04, 2026
`4.1.2` patch	Aug 04, 2026
`4.1.1` patch	Aug 04, 2026
`4.1.0` minor	Aug 04, 2026
`4.0.26` patch	Aug 03, 2026
`4.0.25` patch	Jul 31, 2026
`4.0.24` patch	Jul 30, 2026
`4.0.23` patch	Jul 30, 2026
`4.0.22` patch	Jul 30, 2026
`4.0.21` patch	Jul 28, 2026
`4.0.20` patch	Jul 28, 2026
`4.0.19` patch	Jul 24, 2026
`4.0.18` patch	Jul 24, 2026
`4.0.16` patch	Jul 22, 2026
`4.0.15` patch	Jul 21, 2026
`4.0.14` patch	Jul 21, 2026
`4.0.13` patch	Jul 16, 2026
`4.0.12` patch	Jul 16, 2026
`4.0.11` patch	Jul 09, 2026
`4.0.10` patch	Jul 08, 2026
`4.0.9` patch	Jul 07, 2026
`4.0.8` patch	Jul 06, 2026
`4.0.7` patch	Jul 03, 2026
`4.0.5` patch	Jul 03, 2026
`4.0.6` patch	Jul 03, 2026
`4.0.4` patch	Jul 02, 2026
`4.0.3` patch	Jul 02, 2026
`4.0.2` patch	Jul 01, 2026
`4.0.1` patch	Jun 26, 2026
`4.0.0` major	Jun 26, 2026

1–50 of 681

Repository

avo-hq/avo

Forks: 317
Open issues: 182
Language: Ruby

rails
ruby
admin
crud
fast
maintainable

Dependencies (14)

Depends on

4.2.3

Used by

Supply-chain exposure

3 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (8)

CVE-2026-53769 GHSA-pqpw-cvm4-8mv9 Jul 09, 2026

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

6.5 / 10
Medium
Network Low Low None Unchanged None High None

Summary

Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?.

An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation.

This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies.

Details

Avo exposes a direct attachment upload endpoint:

POST /<avo-root>/avo_api/resources/:resource_name/:id/attachments/

The vulnerable code path is Avo::AttachmentsController#create:

app/controllers/avo/attachments_controller.rb:9-24

Current behavior:

def create blob = ActiveStorage::Blob.create_and_upload! io: params[:file].to_io, filename: params[:filename] association_name = BaseResource.valid_attachment_name(@record, params[:attachment_key]) if association_name @record.send(association_name).attach blob elsif params[:key].blank? raise ActionController::BadRequest.new(...) end render json: { url: main_app.url_for(blob), href: main_app.url_for(blob) } end

This endpoint creates an ActiveStorage::Blob before validating the requested attachment association and before any upload authorization could be enforced. If attachment_key resolves to an association, the blob is attached to the target record. If the request uses the key-based/Trix path, the endpoint can still persist the blob and return url/href even when no attachment association is resolved on the target record.

The controller never calls:

@resource.authorization.authorize_action("upload_<field>?", record: @record, ...)

@resource.authorization.authorize_action("update?", record: @record, ...)

This is inconsistent with the rest of Avo's file authorization implementation. The field-level file authorization concern defines upload authorization as:

lib/avo/fields/concerns/file_authorization.rb:11-12

lib/avo/fields/concerns/file_authorization.rb:25-27

def can_upload_file? authorize_file_action(:upload) end def authorize_file_action(action) authorize_action("#{action}_#{id}?", record: record, raise_exception: false) end

That upload policy is used by UI components to decide whether to render upload controls, but the server-side upload endpoint does not enforce the same policy. A user can therefore bypass the policy by directly POSTing to the endpoint.

By contrast, attachment deletion does call attachment-specific authorization:

app/controllers/avo/attachments_controller.rb:27-65

def destroy if authorized_to :delete ... end end def authorized_to(action) @resource.authorization.authorize_action("#{action}_#{params[:attachment_name]}?", record: @record, raise_exception: false) end

The asymmetry is:

destroy: calls delete_<attachment_name>?

create: does not call upload_<attachment_key>? or update?

The field-level upload authorization intent is also documented by Avo:

Issue #1624 requested the "Ability to police each file upload/download/delete". https://github.com/avo-hq/avo/issues/1624

PR #1625 introduced upload_cover_photo? as an example upload policy method. https://github.com/avo-hq/avo/pull/1625

PR #1667 clarified the policy semantics: "From now on, only field level authorization will be considered. If it is defined and returns true, the action will be granted; otherwise, it will not." https://github.com/avo-hq/avo/pull/1667

The current Avo authorization documentation lists upload_{FIELD_ID}? as the policy method controlling whether a user can upload an attachment, stating: "Controls whether the user can upload the attachment." https://docs.avohq.io/4.0/authorization.html

The same documentation says the same upload_file? policy method will be used to "authorize the file upload" in action file fields. https://docs.avohq.io/4.0/authorization.html

Affected versions observed:

PoC-confirmed: Avo 3.31.2, commit 46aa6b3bc9e3283110c39e58cfec8bb95adc1897

Same vulnerable code path by source inspection: origin/main HEAD as of 2026-05-29, 9e23ddc88f2b1e762e4a5ec35a6f86370ac16c73

Same vulnerable code path by source inspection: Avo v4.0.0.beta.26, 6d339595a27f8779cb99b4aa38ddc97cb702b30f

Same vulnerable code path by source inspection: origin/4-dev at version 4.0.0.beta.40, 7ab9794f8b044b11b9677cdc57547d99cf96c3f3

Suggested affected range for the GitHub Security Advisory form:

>= 2.28.0

Rationale:

The direct attachment upload endpoint exists without upload authorization from commit ab5f5970e2aa76e6ca0a95bf04f510ba7ed5e858 (feature: trix attachments, 2021-04-24), first included in tag v1.4.0.

The documented field-level upload policy bypass is confirmed from commit 667049ceeda838394214489693d088708d9da77d (feature: field level file authorization, 2023-03-12), first included in tag v2.28.0.

PR #1667 later clarified the field-level-only grant/deny semantics in commit 31b6ef94f8cc4c340a2a75eec36c838cda933ce7, first included in tag v2.30.1.

From a narrow missing-authorization perspective, the issue exists from v1.4.0; the >= 2.28.0 range is a conservative submission range anchored to the documented field-level upload policy boundary.

Fixed version: to be determined by maintainers.

PoC

A local request spec was used to reproduce the issue. The PoC adds pundit to the test group and replaces Avo::Services::AuthorizationService with a test double. The test double records every authorize_action invocation and, when invoked, delegates the decision to a PostPolicy resolved via Pundit.policy!.

The policy setup is:

PostPolicy#update? returns false

PostPolicy#upload_attachments? returns false

PostPolicy#upload_cover_photo? returns false

PostPolicy#method_missing returns true for all other policy methods ending in ?, simulating a user with general read access but explicit update/upload denial

the replacement authorization service records all authorize_action calls

The open-source repository does not include Avo Pro's authorization client. The critical observation is independent of which client is plugged in: the vulnerable endpoint never invokes authorize_action at all, so the call list remains empty.

The PoC user has roles: {admin: true}, which is required only to pass the dummy app's coarse route-level guard:

authenticate :user, ->(user) { user.is_admin? }

The vulnerability under test is one layer below that guard: the fine-grained record/field authorization that Avo Pro/Pundit deployments would normally enforce. The dummy route gate is not part of Avo's upload policy decision. In a deployment where non-admin operators reach Avo through a different authentication rule, AttachmentsController#create would still skip authorize_action for the upload.

Policy scoping is orthogonal to this finding. Even if apply_policy filtered the record set during lookup, AttachmentsController#create would still not authorize the upload action itself for records that survive the scope.

The spec demonstrates:

Normal record update is denied by policy and does not persist changes.

Direct upload with attachment_key=cover_photo succeeds even though PostPolicy#upload_cover_photo? returns false, replacing the existing has_one_attached cover_photo blob.

Direct upload with attachment_key=attachments succeeds even though PostPolicy#upload_attachments? returns false, adding to a has_many_attached association.

Direct upload with params[:key] and no attachment association succeeds, creates an ActiveStorage::Blob, and returns url/href without attaching the blob to the record.

The direct upload requests do not invoke the replacement authorization service at all.

The full request-spec patch can be provided in this advisory thread if useful.

Verification environment:

Ruby 3.3.1

Avo 3.31.2

Commit 46aa6b3bc9e3283110c39e58cfec8bb95adc1897

Impact

This is a missing server-side authorization vulnerability in Avo's direct attachment upload endpoint.

The primary affected deployments are Avo Pro/Advanced-style multi-role deployments where non-administrator or restricted operator users can reach Avo, and per-record/per-field operations are expected to be enforced by policies.

In such deployments, an authenticated Avo user can add or replace attachment content on a resolved record even when the host application policy denies both:

record update, for example update?

field-level upload, for example upload_cover_photo? or upload_attachments?

For has_one_attached fields, the demonstrated impact is replacement of a protected attachment field with attacker-controlled content. The attacker controls the uploaded binary content, filename, and content-type metadata for the reachable field.

For key-based/Trix upload flows, the endpoint can persist a blob and return a URL even when no attachment association is resolved. This means the endpoint should not be left as an unauthenticated blob creation and URL return path for authenticated Avo users.

In admin-only deployments following the Avo Community pattern, practical exposure is much lower because the only users who can reach the endpoint are already trusted to perform record updates through the normal CRUD path.

Suggested fix direction:

validate the requested attachment_key before any blob is stored

perform upload authorization before ActiveStorage::Blob.create_and_upload!

derive the policy method from the validated association name rather than raw request input

apply an equivalent authorization decision to supported params[:key] / Trix upload flows before blob creation or URL return

return a JSON-compatible 403 Forbidden response when upload authorization is denied

The default Avo::Services::AuthorizationService#authorize_action returns true in lib/avo/services/authorization_service.rb:34-35, so applications without a custom authorization client should not see a behavior change from adding an authorization call. Deployments with custom/Pro authorization clients that explicitly deny upload would gain enforcement at this endpoint.

No official Avo-level workaround was confirmed in this review. Until a fix is available, applications can reduce exposure by ensuring only fully trusted administrators can access Avo routes.

Applications needing an immediate mitigation may override or monkey-patch Avo::AttachmentsController#create to authorize uploads before blob creation. Any mitigation should be tested against the application's Avo authorization client and upload UI, because the endpoint is used by Trix/file upload flows. If a mitigation falls back to update? for key-based/Trix uploads, that is a conservative behavior change for applications that currently allow read-only operators to use those uploads; those deployments should replace the fallback with an explicit rich-text upload policy.

Affected versions

2.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr1683

+ 269 more Show less

2.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.47.02.48.02.49.02.50.02.51.02.52.02.53.03.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre193.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.10.03.10.13.10.103.10.23.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.13.11.103.11.23.11.33.11.43.11.53.11.63.11.73.11.83.11.93.12.03.13.03.13.13.13.23.13.33.13.43.13.53.13.63.13.73.14.03.14.13.14.23.14.33.14.43.14.53.15.03.15.13.15.23.15.33.15.43.15.53.15.63.15.73.16.03.16.13.16.23.16.33.16.43.16.53.16.63.17.03.17.13.17.1.tw43.17.23.17.2.tw43.17.33.17.3.tw43.17.43.17.4.tw43.17.53.17.5.tw43.17.63.17.6.tw43.17.73.17.83.17.8.tw43.17.93.17.9.beta13.17.9.beta23.17.9.tw43.18.03.18.0.tw43.18.13.18.1.tw43.18.23.18.2.tw43.19.03.19.13.19.23.19.33.2.03.2.13.2.23.2.33.20.03.20.13.20.23.20.33.21.03.21.13.22.03.22.23.22.33.22.43.22.53.23.03.23.13.24.03.24.13.25.03.25.13.25.23.25.33.26.03.26.23.26.33.26.43.27.03.28.03.29.03.29.13.3.03.3.13.3.23.3.33.3.43.3.53.3.63.30.03.30.13.30.23.30.33.30.43.31.03.31.13.31.23.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.6.beta13.5.73.5.83.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.7.33.7.43.8.03.8.13.8.23.9.03.9.13.9.2

Fixed in

3.32.0

References

https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v3.32.0

Updated Jul 09, 2026 · Source: OSV.dev
CVE-2026-55518 GHSA-8fq9-273g-6mrg Jun 17, 2026

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

9.6 / 10
Critical
Network Low Low None Changed High High None

Summary

A critical missing authorization flaw exists in Avo's association attach workflow. The UI and GET /resources/:resource/:id/:related/new path can check attach_<association>?, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association.

As a result, an authenticated low-privileged Avo user can bypass hidden/disabled attach controls and directly attach related records to a parent record by sending a crafted POST request. In applications where associations represent teams, tenants, roles, projects, users, memberships, ownership, or other authorization-bearing relationships, this can lead to privilege escalation and cross-tenant data exposure.

Details

The association attach route writes relationships through Avo::AssociationsController#create:

# config/routes.rb post "/:resource_name/:id/:related_name", to: "associations#create", as: "associations_create"

The controller registers an attach authorization callback only for new, not for create:

# app/controllers/avo/associations_controller.rb before_action :set_attachment_record, only: [:create, :destroy] before_action :authorize_index_action, only: :index before_action :authorize_attach_action, only: :new before_action :authorize_detach_action, only: :destroy

The new action is only the form-rendering step. The actual mutation happens in create:

def create if create_association create_success_action else create_fail_action end end

create_association then attaches the attacker-supplied related record to the parent:

def create_association association_name = BaseResource.valid_association_name(@record, association_from_params) perform_action_and_record_errors do if through_reflection? && additional_params.present? new_join_record.save elsif has_many_reflection? || through_reflection? @record.send(association_name) << @attachment_record else @record.send(:"#{association_name}=", @attachment_record) @record.save! end end end

The only attach-specific authorization helper is:

def authorize_attach_action authorize_if_defined "attach_#{@field.id}?" end

Because this helper is bound only to new, a policy that denies attach_users?, attach_teams?, attach_roles?, or similar methods blocks the UI/form path but does not protect the write path.

This is inconsistent with the detach path, which does authorize the mutating destroy action:

before_action :authorize_detach_action, only: :destroy

The bug is especially dangerous because Avo already treats association authorization as an access-control boundary in UI components:

# lib/avo/concerns/checks_assoc_authorization.rb method_name = :"#{policy_method}_#{association_name}?".to_sym if service.has_method?(method_name, raise_exception: false) service.authorize_action(method_name, record:, raise_exception: false) else !Avo.configuration.explicit_authorization end

However, server-side enforcement is missing on the actual attach POST endpoint.

Proof of Concept

Prerequisites:

A Rails application mounts Avo, for example at /admin.

Avo authorization is enabled.

A low-privileged user can authenticate to Avo.

A parent record and a related record are both reachable by ID.

The relevant policy denies attaching the relationship, for example:

def attach_users? false end

Example target scenario:

Parent resource: projects

Parent ID: 1

Related association: users

Related user ID to attach: 42

Expected policy: low-privileged users must not be able to attach users to projects.

The UI/form request may be blocked:

GET /admin/resources/projects/1/users/new

But the direct write endpoint can still be invoked:

POST /admin/resources/projects/1/users Content-Type: application/x-www-form-urlencoded authenticity_token=<CSRF>&fields[related_id]=42

Run the attached PoC:

python poc_avo_association_attach_bypass.py \ --base-url http://localhost:3000 \ --avo-root /admin \ --cookie "_app_session=<LOW_PRIVILEGED_SESSION_COOKIE>" \ --parent-resource projects \ --parent-id 1 \ --related-name users \ --related-id 42 \ --check-new

If GET /new is forbidden or redirected but the direct POST succeeds, the authorization bypass is confirmed.

To perform the actual attach:

python poc_avo_association_attach_bypass.py \ --base-url http://localhost:3000 \ --avo-root /admin \ --cookie "_app_session=<LOW_PRIVILEGED_SESSION_COOKIE>" \ --parent-resource projects \ --parent-id 1 \ --related-name users \ --related-id 42 \ --confirm-attach

Expected vulnerable result:

The low-privileged user can attach the related record despite attach_<association>? being denied.

The parent record now includes the related record.

Impact

This vulnerability allows unauthorized relationship manipulation through Avo.

Depending on the affected association, the impact can include:

Privilege escalation by attaching a user to an admin group, privileged project, tenant, organization, role, or membership record.

Cross-tenant data exposure when tenant/user/project membership determines record visibility.

Integrity loss by changing ownership, assignment, access-control relationships, or business workflow state.

Policy bypass even when Avo UI controls correctly hide the attach button or deny the attach form.

Recommended Fix

Enforce attach authorization on the mutating endpoint.

At minimum:

before_action :authorize_attach_action, only: [:new, :create]

Additionally:

Authorize against the parent record and the selected related record before writing the relationship.

Ensure create fails closed when attach_<association>? is missing and explicit_authorization is enabled.

Add regression tests that directly POST to /resources/:resource_name/:id/:related_name while attach_<association>? returns false.

Verify has_many, has_one, has_many :through, and has_and_belongs_to_many association paths all enforce the same server-side authorization.

Affected versions

0.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.3

+ 609 more Show less

0.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.4.02.4.12.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.47.02.48.02.49.02.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.50.02.51.02.52.02.53.02.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre13.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre193.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.10.03.10.13.10.103.10.23.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.13.11.103.11.23.11.33.11.43.11.53.11.63.11.73.11.83.11.93.12.03.13.03.13.13.13.23.13.33.13.43.13.53.13.63.13.73.14.03.14.13.14.23.14.33.14.43.14.53.15.03.15.13.15.23.15.33.15.43.15.53.15.63.15.73.16.03.16.13.16.23.16.33.16.43.16.53.16.63.17.03.17.13.17.1.tw43.17.23.17.2.tw43.17.33.17.3.tw43.17.43.17.4.tw43.17.53.17.5.tw43.17.63.17.6.tw43.17.73.17.83.17.8.tw43.17.93.17.9.beta13.17.9.beta23.17.9.tw43.18.03.18.0.tw43.18.13.18.1.tw43.18.23.18.2.tw43.19.03.19.13.19.23.19.33.2.03.2.13.2.23.2.33.20.03.20.13.20.23.20.33.21.03.21.13.22.03.22.23.22.33.22.43.22.53.23.03.23.13.24.03.24.13.25.03.25.13.25.23.25.33.26.03.26.23.26.33.26.43.27.03.28.03.29.03.29.13.3.03.3.13.3.23.3.33.3.43.3.53.3.63.30.03.30.13.30.23.30.33.30.43.31.03.31.13.31.23.32.03.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.6.beta13.5.73.5.83.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.7.33.7.43.8.03.8.13.8.23.9.03.9.13.9.24.0.0.beta.14.0.0.beta.104.0.0.beta.114.0.0.beta.124.0.0.beta.134.0.0.beta.144.0.0.beta.154.0.0.beta.164.0.0.beta.174.0.0.beta.184.0.0.beta.194.0.0.beta.24.0.0.beta.204.0.0.beta.214.0.0.beta.224.0.0.beta.234.0.0.beta.244.0.0.beta.254.0.0.beta.264.0.0.beta.274.0.0.beta.284.0.0.beta.294.0.0.beta.34.0.0.beta.304.0.0.beta.314.0.0.beta.324.0.0.beta.334.0.0.beta.344.0.0.beta.354.0.0.beta.364.0.0.beta.374.0.0.beta.384.0.0.beta.394.0.0.beta.44.0.0.beta.404.0.0.beta.414.0.0.beta.424.0.0.beta.434.0.0.beta.444.0.0.beta.454.0.0.beta.464.0.0.beta.474.0.0.beta.484.0.0.beta.494.0.0.beta.54.0.0.beta.504.0.0.beta.64.0.0.beta.74.0.0.beta.84.0.0.beta.9

Fixed in

3.32.14.0.0.beta.51

References

https://github.com/avo-hq/avo/security/advisories/GHSA-8fq9-273g-6mrg
https://nvd.nist.gov/vuln/detail/CVE-2026-55518
https://github.com/avo-hq/avo/pull/4568
https://github.com/avo-hq/avo/commit/995928e586fd1788dd496bd51c4dbe4a79cb2b9c
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v3.32.1

Updated Jul 18, 2026 · Source: OSV.dev
CVE-2026-42205 GHSA-qc5p-3mg5-9fh8 Apr 24, 2026

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

8.8 / 10
High
Network Low Low None Unchanged High High High

Summary

A critical Broken Access Control vulnerability was identified in the ActionsController of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.

Details

The vulnerability exists in the action_class method within app/controllers/avo/actions_controller.rb.

Vulnerable Code

def action_class # It searches through ALL descendants of BaseAction without resource validation Avo::BaseAction.descendants.find do |action| action.to_s == params[:action_id] end end

The controller identifies the action class to execute solely based on the params[:action_id] by searching through all BaseAction descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., /admin/resources/posts/actions).

Consequently, an attacker can invoke sensitive actions (e.g., Avo::Actions::ToggleAdmin) through an unrelated resource endpoint (e.g., Post), bypassing the intended resource-action mapping.

Impact

This flaw results in significant security risks:

Privilege Escalation: An authenticated user with low privileges can execute administrative actions (like toggling admin roles) to escalate their own or others' permissions.

Unauthorized Operations: Actions designed for restricted resources can be triggered against any record ID in the database.

Data Integrity Compromise: Attackers can perform unauthorized destructive operations (e.g., Delete, Archive, or Update) on records they should not have access to.

Proof of Concept (PoC)

Steps to Reproduce:

Log in to the Avo admin panel with limited permissions.

Identify a target record ID (e.g., User ID: 1) and a sensitive action class (e.g., Avo::Actions::ToggleAdmin).

Send a POST request to a resource endpoint where the target action is not registered:

URL: POST /admin/resources/posts/actions

Payload: action_id=Avo::Actions::ToggleAdmin&fields[avo_resource_ids]=1

The server executes the ToggleAdmin logic on User 1, even though the request was made through the posts resource context.

PoC Script Snippet:

# Simulating the unauthorized action execution data = { 'action_id': 'Avo::Actions::ToggleAdmin', 'fields[avo_resource_ids]': '1', # Target Record ID 'authenticity_token': csrf_token } response = session.post(f"{BASE_URL}/admin/resources/posts/actions", data=data)

Remediation

Restrict the action lookup to only those actions explicitly registered for the current resource context:

def action_class # Validate that the action is registered for the current resource @resource.get_actions.find do |action| action.to_s == params[:action_id] end end

Discoverer

Illunight

Affected versions

0.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.3

+ 557 more Show less

0.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.4.02.4.12.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.47.02.48.02.49.02.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.50.02.51.02.52.02.53.02.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre13.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre193.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.10.03.10.13.10.103.10.23.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.13.11.103.11.23.11.33.11.43.11.53.11.63.11.73.11.83.11.93.12.03.13.03.13.13.13.23.13.33.13.43.13.53.13.63.13.73.14.03.14.13.14.23.14.33.14.43.14.53.15.03.15.13.15.23.15.33.15.43.15.53.15.63.15.73.16.03.16.13.16.23.16.33.16.43.16.53.16.63.17.03.17.13.17.1.tw43.17.23.17.2.tw43.17.33.17.3.tw43.17.43.17.4.tw43.17.53.17.5.tw43.17.63.17.6.tw43.17.73.17.83.17.8.tw43.17.93.17.9.beta13.17.9.beta23.17.9.tw43.18.03.18.0.tw43.18.13.18.1.tw43.18.23.18.2.tw43.19.03.19.13.19.23.19.33.2.03.2.13.2.23.2.33.20.03.20.13.20.23.20.33.21.03.21.13.22.03.22.23.22.33.22.43.22.53.23.03.23.13.24.03.24.13.25.03.25.13.25.23.25.33.26.03.26.23.26.33.26.43.27.03.28.03.29.03.29.13.3.03.3.13.3.23.3.33.3.43.3.53.3.63.30.03.30.13.30.23.30.33.30.43.31.03.31.13.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.6.beta13.5.73.5.83.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.7.33.7.43.8.03.8.13.8.23.9.03.9.13.9.2

Fixed in

3.31.2

References

https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
https://nvd.nist.gov/vuln/detail/CVE-2026-42205
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v3.31.2
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml

Updated Jun 08, 2026 · Source: OSV.dev
CVE-2026-33209 GHSA-762r-27w2-q22j Mar 18, 2026

Avo has a XSS vulnerability on `return_to` param

Medium
Network Low None

Description

A reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface.

An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button.

Impact

This vulnerability may allow execution of arbitrary JavaScript in the context of the application.

Impact varies depending on deployment:

In unauthenticated setups: exploitable via crafted links sent to users

In authenticated setups: limited to authenticated users and requires interaction

Affected versions

0.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.3

+ 553 more Show less

0.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.4.02.4.12.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.47.02.48.02.49.02.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.50.02.51.02.52.02.53.02.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre13.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre193.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.10.03.10.13.10.103.10.23.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.13.11.103.11.23.11.33.11.43.11.53.11.63.11.73.11.83.11.93.12.03.13.03.13.13.13.23.13.33.13.43.13.53.13.63.13.73.14.03.14.13.14.23.14.33.14.43.14.53.15.03.15.13.15.23.15.33.15.43.15.53.15.63.15.73.16.03.16.13.16.23.16.33.16.43.16.53.16.63.17.03.17.13.17.1.tw43.17.23.17.2.tw43.17.33.17.3.tw43.17.43.17.4.tw43.17.53.17.5.tw43.17.63.17.6.tw43.17.73.17.83.17.8.tw43.17.93.17.9.beta13.17.9.beta23.17.9.tw43.18.03.18.0.tw43.18.13.18.1.tw43.18.23.18.2.tw43.19.03.19.13.19.23.19.33.2.03.2.13.2.23.2.33.20.03.20.13.20.23.20.33.21.03.21.13.22.03.22.23.22.33.22.43.22.53.23.03.23.13.24.03.24.13.25.03.25.13.25.23.25.33.26.03.26.23.26.33.26.43.27.03.28.03.29.03.29.13.3.03.3.13.3.23.3.33.3.43.3.53.3.63.30.03.30.13.30.23.4.03.4.13.4.23.4.33.4.43.5.03.5.13.5.23.5.33.5.43.5.53.5.63.5.6.beta13.5.73.5.83.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.7.33.7.43.8.03.8.13.8.23.9.03.9.13.9.2

Fixed in

3.30.3

References

https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j
https://nvd.nist.gov/vuln/detail/CVE-2026-33209
https://github.com/avo-hq/avo/pull/4330
https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v3.30.3

Updated Mar 25, 2026 · Source: OSV.dev
CVE-2024-22411 GHSA-g8vp-2v5p-9qfh Jan 17, 2024

Cross-site scripting (XSS) in Action messages on Avo

6.5 / 10
Medium
Network Low Low Required Changed Low Low Low

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.

Affected versions

3.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre19

+ 396 more Show less

3.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.2.03.2.13.2.23.2.30.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.4.02.4.12.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre1

Fixed in

2.47.03.3.0

References

https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh
https://nvd.nist.gov/vuln/detail/CVE-2024-22411
https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347
https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v2.47.0

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-22191 GHSA-ghjv-mh6x-7q6h Jan 16, 2024

avo vulnerable to stored cross-site scripting (XSS) in key_value field

7.3 / 10
High
Network Low Low Required Unchanged High High None

Summary

A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser.

Details

The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.

This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.

In avo/fields/common/key_value_component.html.erb the value is taken in lines 38 and 49 and seems to be interpreted directly as html in lines 44 and 55.

PoC

To reproduce the vulnerability, follow these steps:

Edit an entry with a key_value field.

Enter the following payload into the value field: POC\"> <script>alert( 'XSS in key_value' );</script> <strong>Outside-tag</strong

Save the entry.

Go to the index page and click on the eye icon next to the entry.

The malicious JavaScript code will be executed and an alert box will be displayed. On the show and edit page the alert seems not to pop up, but the strong tag breaks out of the expected html tag

Impact

This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites.

Affected versions

3.0.0.beta13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre133.0.0.pre143.0.0.pre153.0.0.pre163.0.0.pre173.0.0.pre183.0.0.pre19

+ 396 more Show less

3.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre93.0.1.beta13.0.1.beta103.0.1.beta113.0.1.beta123.0.1.beta133.0.1.beta143.0.1.beta153.0.1.beta163.0.1.beta173.0.1.beta183.0.1.beta193.0.1.beta23.0.1.beta203.0.1.beta213.0.1.beta223.0.1.beta233.0.1.beta243.0.1.beta33.0.1.beta43.0.1.beta53.0.1.beta63.0.1.beta73.0.1.beta83.0.1.beta93.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.2.03.2.13.2.23.2.30.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.32.33.3.pre.12.33.3.pre.22.34.02.34.12.34.22.34.32.34.42.34.4.pre.12.34.52.34.62.34.7.pre.12.35.02.36.02.36.12.36.22.36.32.37.02.37.12.37.22.38.02.39.02.4.02.4.12.40.02.41.02.42.02.42.12.42.22.43.02.44.02.45.02.46.02.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre1

Fixed in

2.47.03.2.4

References

https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h
https://nvd.nist.gov/vuln/detail/CVE-2024-22191
https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347
https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258
https://github.com/avo-hq/avo
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22191.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-34102 GHSA-86h2-2g4g-29qx Jun 06, 2023

avo possible unsafe reflection / partial DoS vulnerability

8.3 / 10
High
Network Low Low None Unchanged Low High High

Summary

The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record.

Details

After reviewing the polymorphic field implementation and performing some black box approaches, we identified a potential security issue related to the use of safe_constantize / constantize. This Rails functionality is capable of searching for classes within the Rails context and returning the class for further use. Because Avo does not validate user input when updating or creating a new polymorphic resource, it is possible to create database entries with completely different or invalid class names than the preselected ones. Avo assumes that the class specified by the user request is a valid one and attempts to work with it, which may result in dangerous behavior and code execution.

PoC

In the test scenario we choose the demo app and the review resource which has a polymorphic reviewable field.

Intercepting the request and switching the review[reviewable_type] from “Fish” to “File” which is a real class inside Rails

Corrupting the database with unusable classes will cause a crash at the application while viewing the new record or the index view (partial DoS)

Manual delete the corrupted resource in order to recover the applications functionality

Of course it is possible to use other class names or namespaces. The local development environment displays the backend error message when visiting a corrupted record. Avo is trying to apply a scope to this class that does not exist.

Specifying an invalid class name in the parameter will cause the application to crash again while trying constanize the provided string

Impact

The final exploitation of this vulnerability requires more time than is provided in this assessment, but initial testing of the post request shows the potential critical risk. The classes could be instantiated at any point in the code and this could also lead to code execution.

Recommendation

Avo should be configured to never trust user-supplied input, especially when defining classes for records. In this particular case, Avo can evaluate the options list given for the polymorphic field and only allow strings from that list. With this white-list approach, an attacker cannot supply unintended classes.

Affected versions

0.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.3

+ 316 more Show less

0.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.3.pre.12.33.3.pre.22.4.02.4.12.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre9

Fixed in

2.33.3

References

https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx
https://nvd.nist.gov/vuln/detail/CVE-2023-34102
https://github.com/avo-hq/avo/commit/ec117882ddb1b519481bdd046dc3cfa4474e6e17
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v2.33.3
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2023-34102.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-34103 GHSA-5cr9-5jx3-2g39 Jun 06, 2023

avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

7.3 / 10
High
Network Low Low Required Unchanged High High None

Summary

Some avo fields are vulnerable to XSS when rendering html based content.

Details

During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix editor in the backend to edit rich text data which basically operates with html tags. To display the stored data in a rendered view, the HasHTMLAttributes concern is used. This can be exploited by an attacker to store javascript code in any trix field by intercepting the request and modifying the post data, as the trix editor does not allow adding custom html or js tags on the frontend.

PoC

Adding javascript in the post request which is used when editing a "post" resource (body is declared as a trix field)

Successful execution of JS code on live demo environment

Impact

Unlike non-persistent XSS, persistent XSS does not require a social engineering phase. Victims of this attack do not need to be tricked into clicking a link or something like that. However, by exploiting such a vulnerability on this particular target, attackers may be able to gain access to accounts that require special protection, such as administrators of the web service, which is what Avo is primarily intended to be used for.

Recommendation

The content of a field that contains html code should be sanitized using the according rails helper which uses a whitelist of known-safe tags and attributes. Also this security consideration should be applied to the “as_html” attribute as well because it may contain user controlled input as well.

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html

Affected versions

0.2.00.2.10.2.20.2.30.2.40.2.50.3.10.3.20.4.10.4.100.4.20.4.3

+ 316 more Show less

0.4.40.4.50.4.60.4.70.4.80.4.90.5.0.beta10.5.0.beta100.5.0.beta110.5.0.beta120.5.0.beta130.5.0.beta140.5.0.beta150.5.0.beta20.5.0.beta30.5.0.beta40.5.0.beta50.5.0.beta60.5.0.beta70.5.0.beta80.5.0.beta91.0.01.0.11.0.21.0.41.0.51.1.01.1.0.pre.11.10.01.10.11.10.21.10.31.11.01.11.11.11.21.11.31.11.41.11.51.11.61.12.01.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.15.01.15.0.pre.11.16.01.16.11.16.21.16.31.16.41.17.01.17.11.18.01.18.0.pre.11.18.0.pre.21.18.0.pre.31.18.11.18.21.18.2.pre.01.19.01.19.1.pre.11.19.1.pre.101.19.1.pre.111.19.1.pre.21.19.1.pre.31.19.1.pre.41.19.1.pre.51.19.1.pre.61.19.1.pre.71.19.1.pre.81.19.1.pre.91.2.101.2.11.pre.11.2.11.pre.21.2.11.pre.31.2.11.pre.41.2.21.2.31.2.41.2.51.2.61.2.6.pre.11.2.71.2.81.2.91.20.11.20.2.pre.11.20.2.pre.21.21.01.21.0.pre.11.21.1.pre.11.22.01.22.0.pre.11.22.11.22.1.pre.11.22.1.pre.21.22.21.22.31.22.41.23.01.24.01.24.11.24.21.25.01.25.11.25.21.3.01.3.0.pre.11.3.11.3.21.3.31.3.41.3.51.3.5.pre.11.4.01.4.0.pre.11.4.11.4.21.4.31.4.41.4.4.pre.11.4.5.pre.11.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.2.pre.11.6.3.pre.11.6.3.pre.21.6.3.pre.31.6.4.pre.11.7.01.7.11.7.21.7.31.7.3.pre.11.8.01.8.11.8.21.8.31.8.41.9.01.9.12.0.02.1.02.1.12.1.2.pre12.1.2.pre22.10.02.10.22.10.3.pre.12.11.02.11.12.11.1.pre.12.11.1.pre.22.11.1.pre.32.11.2.pre.12.11.2.pre.22.11.2.pre.32.11.3.pre.12.11.3.pre.22.11.3.pre.32.12.02.12.1.pre.12.13.02.13.12.13.2.pre.12.13.2.pre.22.13.3.pre.12.13.3.pre.22.13.3.pre.32.13.3.pre.42.13.4.pre.12.13.5.pre.12.13.5.pre.22.13.6.pre.12.13.6.pre.22.14.02.14.12.14.1.pre.12.14.22.14.2.pre.12.14.3.pre.1.branding2.14.3.pre.2.tailwindcss2.14.3.pre.3.jsbundling2.14.3.pre.4.tosqlfix2.14.3.pre.5.nosprockets2.14.3.pre.6.nosprockets2.14.3.pre.7.polytranslations12.15.02.15.12.15.22.15.2.pre.12.15.32.15.3.pre.1.data.attrs.to.sidebar.items2.16.02.16.1.pre.1.nativefields2.17.02.17.1.pre.1.zeitwerk.eager.load.dir2.17.1.pre.2.customauthorizationclients2.17.1.pre.32.17.1.pre.4.issue.13422.17.1.pre.5.stackedlayout2.18.02.18.12.18.1.pre.1.eagerloaddirs2.19.02.2.02.2.12.2.22.20.02.21.02.21.1.pre.issue14442.21.1.pre.issue14502.21.1.pre.pr14762.21.1.pre.pr14842.21.2.pre.pr14862.21.3.pre.pr14892.22.02.23.02.23.12.23.22.23.3.pre.1.pr15292.24.02.24.12.25.02.25.1.pre.1.pr15792.26.02.26.1.pr1584.pre.12.26.2.pre.pr15792.26.3.pre.pr16012.27.02.27.12.27.2.pre.pr16062.28.02.28.1.pre.pr16422.28.2.pre.pr16422.28.3.pre.pr16462.29.02.29.12.29.1.pre.pr16522.3.02.3.1.pre.12.3.1.pre.22.3.1.pre.32.3.1.pre.42.3.1.pre.52.3.1.pre.62.30.02.30.12.30.1.pre1.pr16832.30.1.pre2.pr16832.30.1.pre3.pr16832.30.1.pre4.pr16832.30.22.31.02.32.02.32.12.32.22.32.32.32.42.32.52.32.62.33.02.33.12.33.22.33.3.pre.12.33.3.pre.22.4.02.4.12.5.02.5.12.5.2.pre.12.5.2.pre.22.5.2.pre.32.5.2.pre.42.5.2.pre.52.5.2.pre.62.5.2.pre.72.6.02.6.1.pre.12.6.1.pre.22.7.02.7.1.pre.12.8.02.9.02.9.1.pre12.9.1.pre22.9.1.pre32.9.1.pre42.9.1.pre52.9.1.pre62.9.1.pre72.9.2.pre13.0.0.pre13.0.0.pre103.0.0.pre113.0.0.pre123.0.0.pre23.0.0.pre33.0.0.pre43.0.0.pre53.0.0.pre63.0.0.pre73.0.0.pre83.0.0.pre9

Fixed in

2.33.3

References

https://github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39
https://nvd.nist.gov/vuln/detail/CVE-2023-34103
https://github.com/avo-hq/avo/commit/7891c01e1fba9ca5d7dbccc43d27f385e5d08563
https://github.com/avo-hq/avo
https://github.com/avo-hq/avo/releases/tag/v2.33.3
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2023-34103.yml

Updated Sep 10, 2026 · Source: OSV.dev