CVE-2024-58353
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
CVSS Score
8.9
EPSS Score
0.0%
EPSS Percentile
0th
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.
| CWE | CWE-80 |
| Vendor | calcom |
| Product | cal.diy |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for calcom cal.diy
Be the first to know when new high vulnerabilities affecting calcom cal.diy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
calcom / cal.diy
0 ≤ 4.7.15
References
Credits
🔍 xyzeva