CVE-2026-54505

UNKNOWN 0.0

TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.

CWE	CWE-79
Vendor	mauriceboe
Product	trek
Published	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for mauriceboe trek

Be the first to know when new unknown vulnerabilities affecting mauriceboe trek are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

mauriceboe / TREK

< 3.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9 github.com: https://github.com/liketrek/TREK/pull/1185 github.com: https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11 github.com: https://github.com/liketrek/TREK/releases/tag/v3.1.0