CVE-2024-58353 in cal.diy
Summary
by MITRE • 07/24/2026
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability exists within the cal.com calendar application where the single booking view endpoint fails to properly sanitize user-provided input when rendering booking question labels. This represents a classic cross-site scripting flaw that allows attackers to inject malicious HTML and JavaScript code into the application's user interface. The issue specifically affects versions 4.7.15 and earlier, with the vulnerability being resolved in version 4.7.16 through proper input sanitization measures.
The technical implementation flaw stems from the application's use of React's dangerouslySetInnerHTML method to render booking question labels without adequate sanitization or content security policy enforcement. This approach bypasses React's built-in security mechanisms that would normally prevent script execution when rendering dynamic content. When an attacker creates a malicious event type with a specially crafted booking question label containing HTML or JavaScript code, that code becomes part of the rendered page and executes in the context of any user who visits the booking view URL.
This vulnerability operates under the common weakness enumeration CWE-79 which specifically addresses cross-site scripting vulnerabilities where untrusted data is incorporated into web pages without proper validation or escaping. The attack vector is particularly dangerous because it leverages legitimate application functionality to deliver malicious payloads, making it difficult to detect through traditional security monitoring approaches. The impact extends beyond simple script execution as attackers can potentially steal session cookies, perform unauthorized actions on behalf of users, or redirect victims to malicious websites.
The operational risk is significantly elevated in self-hosted deployments with open registration mechanisms where any user can create event types and booking questions. This creates an environment where attackers can easily exploit the vulnerability by simply registering an account and creating a malicious event type. The publicly accessible nature of the single booking view URL means that any authenticated or unauthenticated user who visits the page becomes a potential victim, making this a widespread concern for organizations relying on cal.com for scheduling services.
Organizations should immediately upgrade to version 4.7.16 or later to receive the patched implementation that properly sanitizes user input before rendering it in the booking views. Additionally, administrators should implement content security policies that restrict script execution within the application's context and consider implementing input validation at the application level for all user-provided content. The mitigation strategy aligns with ATT&CK technique T1566 which covers social engineering through malicious content delivery, emphasizing the need for proper input validation and output encoding to prevent such vulnerabilities from being exploited in real-world scenarios.