{"action":"Upgrade avo to 2.47.0 or later.","affected":[{"fixed":"3.3.0","introduced":"3.0.0.beta1"},{"fixed":"2.47.0","introduced":"0"}],"component":"avo","cve_ids":["CVE-2024-22411"],"ecosystem":"RubyGems","epss":0.0071,"exploited":false,"fixed_versions":["3.3.0","2.47.0"],"ghsa_id":"GHSA-g8vp-2v5p-9qfh","id":"tcs_01M5KEK8ZCWKFKKSZ469AQM16Q","modified_at":"2026-09-10T03:50:00.599250141Z","published_at":"2024-01-17T22:34:03Z","references":["https://osv.dev/vulnerability/GHSA-g8vp-2v5p-9qfh","https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh","https://nvd.nist.gov/vuln/detail/CVE-2024-22411","https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347","https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258","https://github.com/avo-hq/avo","https://github.com/avo-hq/avo/releases/tag/v2.47.0","https://github.com/avo-hq/avo/releases/tag/v3.3.0","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22411.yml"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-g8vp-2v5p-9qfh","url":"https://osv.dev/vulnerability/GHSA-g8vp-2v5p-9qfh"}],"summary":"Cross-site scripting (XSS) in Action messages on Avo"}