EUVD-2026-63694Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Journey add-on prerequisite justifies AC:H; collaborator must open the page (UI:R); CSP limits impact to UI integrity only (I:L), no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0.
AnalysisAI
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Journey add-on must be explicitly enabled in the TREK deployment (confirmed by CVSS 4.0 AT:P); installations without this add-on active are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.0 accurately reflects multiple compounding constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated TREK trip owner creates or renames a trip with a title containing crafted HTML such as a fake login overlay or a deceptive anchor element. When a collaborator subsequently opens the Journey page, the browser requests GET /api/journeys/suggestions, which returns the unsanitized title; the frontend interpolates it into the i18n template and renders it via dangerouslySetInnerHTML, inserting the attacker-controlled HTML into the collaborator's live DOM. … |
| Remediation | Upgrade to TREK version 3.1.0, which resolves the issue as confirmed by the GitHub release at https://github.com/liketrek/TREK/releases/tag/v3.1.0 and the associated fix commit ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11 (https://github.com/liketrek/TREK/commit/ad893eb1cc75b6d56f402d73a6d41bd48ba7ae11). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OID
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today