CVE-2026-54505: TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREK Journey add-onto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Collaborators who open the authenticated Journey page are exposed when the Journey add-on is enabled and a trip owner has created a qualifying trip with HTML in its title. The affected suggestion is returned by the journey suggestions API and rendered in the collaborator's session.
What must an attacker be able to do to exploit it?
The attacker must be a trip owner able to store HTML in a qualifying trip title. A collaborator must then open the authenticated Journey page so that the suggestion banner renders the title.
Does this allow JavaScript execution?
The injected markup is inserted as live DOM, enabling content spoofing and UI redress. The default Content Security Policy blocks inline event handlers and script execution.
What should be done if patching is not immediately possible?
Disable the Journey add-on to prevent the affected suggestion-banner path from being used. Also review qualifying trip titles created by trip owners for stored HTML and remove unsafe markup.
How can I determine whether an instance is affected?
Instances running a version prior to 3.1.0 are affected when the Journey add-on is enabled. Check whether qualifying trip titles containing HTML are returned by GET /api/journeys/suggestions and displayed on the authenticated Journey page.