CVE-2026-54505

Received Received - Intake

Stored XSS in TREK Travel Planner via Unsanitized Journey Title

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-54505

Affected Vendors & Products

Vendor	Product	Version / Range
trek	trek	3.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in TREK allows a trip owner to inject HTML into a trip title. When another user views the trip, the unescaped title is rendered as live DOM content, enabling content spoofing and UI redress attacks. The default Content Security Policy blocks script execution but not the visual manipulation.

Detection Guidance

This vulnerability can be detected by checking if your TREK instance is running a version prior to 3.1.0. Inspect the version in your deployment or package files. Look for evidence of unescaped HTML injection in trip titles by reviewing stored journey data or API responses from GET /api/journeys/suggestions.

Impact Analysis

If you collaborate on trips in TREK, an attacker could trick you into interacting with fake UI elements or misleading content. This could lead to actions like sharing sensitive trip details or following malicious links, even though scripts cannot execute.

Compliance Impact

This vulnerability may impact compliance by enabling phishing or social engineering attacks that could trick users into disclosing regulated data. However, the lack of script execution limits the severity compared to full code execution vulnerabilities.

Mitigation Strategies

Upgrade TREK to version 3.1.0 or later immediately. If upgrading is not possible, disable the Journey add-on to prevent the vulnerable functionality from being used. Review all trip titles for suspicious HTML content and remove any malicious markup.

Hi! I’m here to help you understand CVE-2026-54505. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70