PT-2026-26213 · Avo · Avo

Timwis · Published 2026-03-18 · Updated 2026-03-24 · CVE-2026-33209

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.30.3

Description A reflected cross-site scripting (XSS) issue exists in the return to query parameter within the Avo interface. An attacker can create a malicious URL that injects arbitrary JavaScript. This JavaScript is executed when a dynamically generated navigation button is clicked. The impact of this issue varies depending on the deployment configuration, potentially allowing the execution of arbitrary JavaScript in the context of the application. In unauthenticated setups, exploitation is possible through crafted links sent to users. In authenticated setups, exploitation is limited to authenticated users and requires interaction.

Recommendations Update to Avo version 3.30.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33209

GHSA-762R-27W2-Q22J

Affected Products

Avo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33209.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-33209.yml · Exploit
• https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j · Vendor Advisory
• https://github.com/avo-hq/avo/pull/4330 · Patch
• https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33209 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33209 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-762r-27w2-q22j · Vendor Advisory
• https://github.com/avo-hq/avo · Note
• https://github.com/avo-hq/avo/releases/tag/v3.30.3 · Note
• https://twitter.com/CVEnew/status/2035262133642915976 · Twitter Post
• https://twitter.com/rubylandnews/status/2036553766351036492 · Twitter Post