PT-2026-79186 · Trek · Trek
CVE-2026-54505
·
Published
2026-08-20
·
Updated
2026-08-20
CVSS v4.0
2.0
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
TREK versions prior to 3.1.0
Description
When the Journey add-on is enabled, the application interpolates the unescaped
activeSuggestion.title value into journey.frontpage.suggestionText via client/src/i18n/TranslationContext.tsx and renders it using dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a trip title, which is then returned via the 'GET /api/journeys/suggestions' endpoint through the getSuggestions(userId) function to a collaborator. This allows the markup to be inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks script execution and inline handlers.Recommendations
Update to version 3.1.0.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Trek