CVE-2024-22191

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.

• CWE-79

• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347Patch
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258Patch
• https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6hExploit, Vendor Advisory
• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347Patch
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258Patch
• https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6hExploit, Vendor Advisory

Published

Jan 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22186The application suffers from a privilege escalation vulnerab…8.8
• CVE-2024-22187A write-what-where vulnerability exists in the Programming S…9.1
• CVE-2024-22188TYPO3 before 13.0.1 allows an authenticated admin user (with…7.2
• CVE-2024-22189quic-go is an implementation of the QUIC protocol in Go. Pri…7.5
• CVE-2024-2219Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-22190GitPython is a python library used to interact with Git repo…7.8
• CVE-2024-22192Ursa is a cryptographic library for use with blockchains. Th…6.5
• CVE-2024-22193The vantage6 technology enables to manage and deploy privacy…4.3
• CVE-2024-22194cdo-local-uuid project provides a specialized UUID-generatin…2.8
• CVE-2024-22195Jinja is an extensible templating engine. Special placeholde…6.1
• CVE-2024-22196Nginx-UI is an online statistics for Server Indicators​​ Mon…6.5
• CVE-2024-22197Nginx-ui is online statistics for Server Indicators​​ Monito…8.8