CVE-2026-54505 in TREK
Summary
by MITRE • 08/21/2026
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in TREK prior to version 3.1.0 represents a classic Stored Cross-Site Scripting (XSS) flaw, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. This security defect arises from the application's failure to properly sanitize user-supplied input before rendering it in a web page context that allows for HTML execution. The core technical issue lies within the client-side JavaScript logic found in src/i18n/TranslationContext.tsx, where the activeSuggestion.title property is interpolated directly into journey.frontpage.suggestionText without any encoding or escaping mechanisms. This unescaped string is subsequently passed to a React component that utilizes dangerouslySetInnerHTML in src/pages/JourneyPage.tsx to render content. By using this method, the application instructs the browser's rendering engine to interpret the provided text as HTML markup rather than plain text, thereby bypassing standard DOM-based XSS protections that typically prevent script execution from simple string injection unless explicitly allowed through such APIs.
The operational impact of this vulnerability is significant because it enables a trip owner to store malicious HTML content within a qualifying trip title. When another user, acting as a collaborator on the same journey, opens the authenticated Journey page, the application fetches the suggestion data via the GET /api/journeys/suggestions endpoint using getSuggestions(userId). The server returns the stored trip title containing the injected markup, which is then rendered in the collaborator's browser session. This results in content spoofing and UI redress attacks where an attacker can manipulate the visual presentation of the application to deceive users or steal sensitive information displayed on the page. Although the default Content Security Policy (CSP) implemented by TREK effectively blocks inline script execution and event handlers, limiting the ability to run arbitrary JavaScript payloads directly from the injected HTML, the vulnerability still poses a risk for phishing attacks, session hijacking through UI manipulation, and potential data exfiltration if other CSP directives are misconfigured or bypassed.
From an industry standard perspective, this flaw aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter when considering the broader context of web application exploitation, although in this specific instance, it is more accurately mapped to CWE-79 due to the lack of input neutralization during output encoding. The vulnerability highlights a critical gap in secure coding practices regarding the handling of dynamic content within single-page applications that rely on client-side rendering engines. Developers must ensure that any data originating from user inputs or database storage is strictly encoded before being inserted into HTML contexts, particularly when using APIs like dangerouslySetInnerHTML which are explicitly designed for raw HTML insertion and carry inherent risks if not used with extreme caution.
To mitigate this vulnerability, the recommended approach involves implementing strict output encoding for all dynamic content rendered in the browser. In React applications, developers should avoid using dangerouslySetInnerHTML unless absolutely necessary and instead rely on standard JSX rendering which automatically escapes text content. If raw HTML is required for legitimate formatting purposes, a robust sanitization library such as DOMPurify should be employed to strip out potentially dangerous tags and attributes before insertion into the DOM. Additionally, reinforcing Content Security Policy headers with strict directives regarding script sources can provide an additional layer of defense against any residual risks from similar vulnerabilities in other parts of the application ecosystem. The issue was addressed in version 3.1.0 by correcting these input handling mechanisms to ensure that user-supplied data is treated as text rather than executable markup, thereby neutralizing the attack vector entirely.