Executive brief
TREK is a collaborative travel planning application. When the Journey add-on is enabled, malicious trip owners can inject unescaped HTML markup into trip titles that gets displayed to collaborators viewing the journey page, enabling content spoofing and UI redress attacks. Although the default Content Security Policy prevents inline script execution, an attacker can still deface the interface or mislead users with fake content.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) issue caused by unsafe DOM manipulation. TREK interpolates unescaped activeSuggestion.title values into journey.frontpage.suggestionText in TranslationContext.tsx, then renders the result using dangerouslySetInnerHTML in JourneyPage.tsx. The attack requires the Journey add-on to be enabled and affects authenticated collaborators who open the Journey page. A trip owner can store HTML in the trip title; when GET /api/journeys/suggestions is called, the malicious title is returned to collaborators and inserted as live DOM in their session. The default CSP blocks inline event handlers and script execution, limiting but not eliminating the impact. The issue was fixed in version 3.1.0.
Affected products
- TREK TREK prior to 3.1.0
Timeline
- 2026-06-16: patched: Fixed in version 3.1.0 (commit ad893eb)
- 2026-08-20: disclosed