TREK, a collaborative travel planning application, stores the active suggestion title unescaped and injects it into the journey suggestion banner using React's dangerouslySetInnerHTML. A trip owner who is able to set a title can embed arbitrary HTML markup, which is then returned by the /api/journeys/suggestions endpoint to authenticated collaborators who view the Journey page. The inserted markup is rendered as live DOM, enabling content spoofing and UI redress. The default Content Security Policy blocks inline handlers and script execution, but does not prevent the injection of undesired markup, potentially allowing attackers to mislead users about trip information. A user with trip owner privileges can store malicious HTML in a qualifying trip title, and when another authenticated collaborator opens the Journey page, the markup is injected directly into the DOM via dangerouslySetInnerHTML, rendering the attacker’s content and potentially deceiving the collaborator. The vulnerability does not give an attacker code execution or direct data exfiltration, but it undermines the authenticity of the interface and can erode user trust in the platform.

Vulnerable only in TREK version 3.0.x and earlier when the Journey add‑on is enabled. The fix was introduced in release 3.1.0, so any installation running a prior release with the add‑on active is susceptible.

According to the CVSS score of 2, the vulnerability is rated low severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating a modest exploitation likelihood. The attack vector is client‑side: an attacker requires an authenticated user to open the Journey page and can craft a malicious trip title to influence the DOM of other collaborators. While the impact is limited to UI deception and does not grant remote code execution, it undermines user trust and can cause confusion. The default CSP mitigates script execution, yet the vulnerability persists due to unsanitized HTML insertion.