Read the docs
TI-2026-39351 Aliases CVE-2026-54505

TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00581 48th percentileScored 2026-11-07
Fix Fixed TREK (mauriceboe): 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mauriceboeTREKbefore 3.1.03.1.0Patch availableCNA
  • TREK Vendormauriceboe Affected before 3.1.0 Fixed in 3.1.0 Patch available CNA

Remediation

  • Fix · CNA TREK (mauriceboe) Fixed in 3.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54505

References

Other 4

  • TI-2026-53961 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL CVSS 3.1HIGH 8.1
  • TI-2026-53960 TREK: Cross-user note-file deletion (IDOR / Broken Access Control) CVSS 3.1HIGH 7.1
  • TI-2026-53966 Information disclosure in mauriceboe TREK CVSS 3.1MEDIUM 5.3
  • TI-2026-33199 Time-based user enumeration in TREK authentication endpoint CVSS 3.1MEDIUM 5.3
  • TI-2026-39355 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) CVSS 3.1MEDIUM 6.5
  • TI-2026-28999 Missing Authorization on Immich Trip Photo Routes in TREK CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences