CVE-2026-54505

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54505", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T18:01:15.512Z", "datePublished": "2026-08-20T21:44:50.337Z", "dateUpdated": "2026-08-25T15:30:48.581Z"}, "containers": {"cna": {"title": "TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"}, {"name": "https://github.com/liketrek/TREK/pull/1185", "tags": ["x_refsource_MISC"], "url": "https://github.com/liketrek/TREK/pull/1185"}, {"name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11", "tags": ["x_refsource_MISC"], "url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"}, {"name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"}], "affected": [{"vendor": "mauriceboe", "product": "TREK", "versions": [{"version": "< 3.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:44:50.337Z"}, "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0."}], "source": {"advisory": "GHSA-g8rf-gqrw-4qf9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T15:30:10.707921Z", "id": "CVE-2026-54505", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:30:48.581Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54505", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:30:10.707921Z"}}}], "references": [{"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:30:38.719Z"}}], "cna": {"title": "TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner", "source": {"advisory": "GHSA-g8rf-gqrw-4qf9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mauriceboe", "product": "TREK", "versions": [{"status": "affected", "version": "< 3.1.0"}]}], "references": [{"url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9", "name": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/liketrek/TREK/pull/1185", "name": "https://github.com/liketrek/TREK/pull/1185", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11", "name": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "name": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:44:50.337Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54505", "state": "PUBLISHED", "dateUpdated": "2026-08-25T15:30:48.581Z", "dateReserved": "2026-06-15T18:01:15.512Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:44:50.337Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "TREK", "vendor": "mauriceboe", "versions": [{"status": "affected", "version": "< 3.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0."}, {"lang": "es", "value": "TREK es un planificador de viajes colaborativo. Antes de la versi\u00f3n 3.1.0, cuando el complemento Journey est\u00e1 habilitado, TREK interpola el valor sin escapar de activeSuggestion.title en journey.frontpage.suggestionText a trav\u00e9s de cliente/src/i18n/TranslationContext.tsx y renderiza el resultado con dangerouslySetInnerHTML en cliente/src/pages/JourneyPage.tsx. Un propietario de viaje puede almacenar HTML en un t\u00edtulo de viaje que califique, y GET /API/journeys/suggestions devuelve ese t\u00edtulo a trav\u00e9s de getSuggestions(userId) a un colaborador que abre la p\u00e1gina Journey autenticada. El marcado se inserta como DOM en vivo en la sesi\u00f3n del colaborador, lo que permite la suplantaci\u00f3n de contenido y la manipulaci\u00f3n de la interfaz de usuario, aunque la Pol\u00edtica de Seguridad de Contenido predeterminada bloquea los manejadores en l\u00ednea y la ejecuci\u00f3n de scripts. Este problema est\u00e1 solucionado en la versi\u00f3n 3.1.0."}], "id": "CVE-2026-54505", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54505", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T15:30:10.707921Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:17:21.263", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11"}, {"source": "security-advisories@github.com", "url": "https://github.com/liketrek/TREK/pull/1185"}, {"source": "security-advisories@github.com", "url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/liketrek/TREK/security/advisories/GHSA-g8rf-gqrw-4qf9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "TREK", "source": "cna", "vendor": "mauriceboe"}, "product": "trek", "vendor": "mauriceboe"}], "created": "2026-08-21T00:45:07.128053+00:00", "updated": "2026-08-21T02:00:04.974219+00:00", "vendors": ["mauriceboe", "mauriceboe$PRODUCT$trek"]}