{"action":"Upgrade avo to 3.30.3 or later.","affected":[{"fixed":"3.30.3","introduced":"0"}],"component":"avo","cve_ids":["CVE-2026-33209"],"ecosystem":"RubyGems","epss":0.00274,"exploited":false,"fixed_versions":["3.30.3"],"ghsa_id":"GHSA-762r-27w2-q22j","id":"tcs_01M5KEHK0S88BFQMD75Z9ZT80T","modified_at":"2026-03-25T19:47:54.819103Z","published_at":"2026-03-18T17:26:59Z","references":["https://osv.dev/vulnerability/GHSA-762r-27w2-q22j","https://github.com/avo-hq/avo/security/advisories/GHSA-762r-27w2-q22j","https://nvd.nist.gov/vuln/detail/CVE-2026-33209","https://github.com/avo-hq/avo/pull/4330","https://github.com/avo-hq/avo/commit/4453d39ddc6309f3bc8ada73ef21e1971112de7d","https://github.com/avo-hq/avo","https://github.com/avo-hq/avo/releases/tag/v3.30.3","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-33209.yml"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-762r-27w2-q22j","url":"https://osv.dev/vulnerability/GHSA-762r-27w2-q22j"},{"source":"nvd","source_id":"CVE-2026-33209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33209"}],"summary":"Avo has a XSS vulnerability on `return_to` param"}