5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33209

CVE-2026-33209: Avo has a XSS vulnerability on `return_to` param

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33209

CVE-2026-33209:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
avo	rubygems	<= 3.30.2	3.30.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the 'avo' gem, specifically concerning the return_to parameter. The root cause of the vulnerability was the improper handling of this parameter, which was passed through the application without adequate sanitization or encoding. The analysis of the patch commit 4453d39ddc6309f3bc8ada73ef21e1971112de7d reveals the core of the issue. The Avo::ApplicationHelper.d method, responsible for decrypting the return_to parameter, was designed to fail open. If decryption failed, it would return the original, untrusted input. An attacker could exploit this by crafting a URL with a malicious JavaScript payload in the return_to parameter. This payload would fail decryption and be passed along, eventually being rendered in an HTML view, such as app/components/avo/referrer_params_component.html.erb, leading to the execution of the script in the user's browser. The Avo::BaseApplicationController.decode_params method was the entry point for this tainted data. The fix involves changing the d method to return nil on decryption failure, effectively blocking the malicious payload. Additionally, the patch enforces encryption and Base64 encoding on the return_to parameter throughout the application to ensure its integrity.

Vulnerable functions

Avo::BaseApplicationController.decode_params

app/controllers/avo/base_application_controller.rb

This method is a `before_action` that processes the `return_to` parameter from the user's request. It calls the `d` helper to decrypt the parameter. The vulnerability lies in how the result of `d` was handled. Before the patch, a failed decryption would return the original malicious payload, which would then be assigned to `params[:return_to]` and used unsanitized throughout the application.

Avo::ApplicationHelper.d

app/helpers/avo/application_helper.rb

The original implementation of the `d` helper function was vulnerable because it would return the original `value` if the decryption process failed. This allowed an attacker to provide a crafted, non-encrypted payload in the `return_to` parameter, which would bypass the decryption and be returned as-is, leading to a reflected XSS vulnerability when this value was rendered in a view.

Avo::Views::ResourceShowComponent.edit_path

app/components/avo/views/resource_show_component.rb

This method constructs arguments for a path helper. Previously, it assigned `request.url` directly to the `return_to` argument without any sanitization or encoding. The patch fixes this by using the `e` helper to encrypt and encode the path, preventing malicious URLs from being used.

Avo::BaseController.redirect_path_from_resource_option

app/controllers/avo/base_controller.rb

This method prepares arguments for a redirect path. It was vulnerable because it took the `return_to` parameter directly from the `params` hash and used it in the redirect URL. An attacker could inject a malicious script into this parameter. The fix applies the `e` helper to encode the parameter before use.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.