# CVE-2026-54505: TREK content spoofing and UI redress in Journey page

Source: https://junglewise.ai/threats/cve-2026-54505-trek-content-spoofing-and-ui-redress-in-journey-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54505 · Severity: info · Published 2026-08-20

TREK is a collaborative travel planning application. When the Journey add-on is enabled, malicious trip owners can inject unescaped HTML markup into trip titles that gets displayed to collaborators viewing the journey page, enabling content spoofing and UI redress attacks. Although the default Content Security Policy prevents inline script execution, an attacker can still deface the interface or mislead users with fake content.

## Quick answers

**Is CVE-2026-54505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54505 being exploited in the wild.

**How severe is CVE-2026-54505?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** TREK TREK prior to 3.1.0.

**Is there a fix for CVE-2026-54505?** A patch was published on 2026-06-16: Fixed in version 3.1.0 (commit ad893eb) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54505 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54505?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) issue caused by unsafe DOM manipulation. TREK interpolates unescaped activeSuggestion.title values into journey.frontpage.suggestionText in TranslationContext.tsx, then renders the result using dangerouslySetInnerHTML in JourneyPage.tsx. The attack requires the Journey add-on to be enabled and affects authenticated collaborators who open the Journey page. A trip owner can store HTML in the trip title; when GET /api/journeys/suggestions is called, the malicious title is returned to collaborators and inserted as live DOM in their session. The default CSP blocks inline event handlers and script execution, limiting but not eliminating the impact. The issue was fixed in version 3.1.0.

## Affected products

- TREK TREK prior to 3.1.0

## Timeline

- 2026-06-16: patched: Fixed in version 3.1.0 (commit ad893eb)
- 2026-08-20: disclosed

## References

- [https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11](https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11)
- [https://github.com/liketrek/TREK/pull/1185](https://github.com/liketrek/TREK/pull/1185)