{"action":"Upgrade avo to 2.47.0 or later.","affected":[{"fixed":"3.2.4","introduced":"3.0.0.beta1"},{"fixed":"2.47.0","introduced":"0"}],"component":"avo","cve_ids":["CVE-2024-22191"],"ecosystem":"RubyGems","epss":0.00745,"exploited":false,"fixed_versions":["3.2.4","2.47.0"],"ghsa_id":"GHSA-ghjv-mh6x-7q6h","id":"tcs_01M5KEKB5R1H37S0PG7AXVQ9GY","modified_at":"2026-09-10T03:50:00.578442921Z","published_at":"2024-01-16T15:24:00Z","references":["https://osv.dev/vulnerability/GHSA-ghjv-mh6x-7q6h","https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h","https://nvd.nist.gov/vuln/detail/CVE-2024-22191","https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347","https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258","https://github.com/avo-hq/avo","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22191.yml"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-ghjv-mh6x-7q6h","url":"https://osv.dev/vulnerability/GHSA-ghjv-mh6x-7q6h"}],"summary":"avo vulnerable to stored cross-site scripting (XSS) in key_value field"}