CVE-2026-57858 in cal.com
Summary
by MITRE • 08/12/2026
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within cal.com diy versions 2.1.1 through 6.2.0 where the BookingPageTagManager component fails to properly sanitize user-supplied analytics tracking IDs. This stored cross-site scripting flaw affects authenticated event owners who can inject malicious javascript code by providing a crafted tracking ID parameter. The vulnerability stems from insufficient input validation and output encoding mechanisms within the application's data processing pipeline. Security researchers have identified this as a critical weakness that violates multiple security principles including the principle of least privilege and proper input sanitization.
The technical exploitation occurs when an authenticated user with event ownership privileges submits a malicious analytics tracking ID containing javascript code. The system stores this input without adequate sanitization, allowing the malicious payload to persist in the database or configuration storage. When visitors access the public booking page, the stored tracking ID gets rendered into the page's html output without proper escaping or encoding. This creates an environment where inline script execution becomes possible through simple string manipulation techniques that close existing script tag literals. The vulnerability specifically targets CWE-79 which defines improper neutralization of input during web page generation, making it a classic stored XSS scenario.
The operational impact of this vulnerability extends beyond simple code injection as it creates persistent attack vectors that can compromise user sessions and enable further exploitation. Attackers can steal session cookies from visitors to the booking page, allowing them to impersonate legitimate users and access sensitive event information or modify booking configurations. The threat model also includes the potential for forged authenticated requests where malicious actors can perform actions on behalf of users without their knowledge. Additionally, the vulnerability enables wormable propagation when combined with CSRF-able endpoints, allowing attackers to automatically inject payloads into multiple events within the same cal.com instance.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application's data flow. The system must sanitize all user-supplied tracking IDs against established character whitelist patterns while maintaining compatibility with legitimate analytics parameters. Security controls should include Content Security Policy headers to prevent unauthorized script execution, proper HTML escaping of dynamic content, and regular security audits of input handling components. Organizations should also implement least privilege access controls for event management functions and consider rate limiting mechanisms to reduce the impact of potential exploitation attempts. The vulnerability aligns with ATT&CK technique T1531 which addresses credential access through malicious scripts and T1059 which covers command and scripting interpreter usage in web applications.