CVE-2024-58353
Cal.com versions up to 4.7.15 allow attackers to inject malicious scripts into booking pages via unsanitized question labels. This cross‑site scripting flaw can run arbitrary code when a visitor opens a booking link. The issue is fixed in version 4.7.16.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Cal.com (repository calcom/cal.diy) versions 4.7.15 and earlier, especially self‑hosted instances with open registration.
Real-world impact
An attacker can run arbitrary JavaScript in the victim’s browser, potentially stealing credentials, hijacking sessions, or redirecting to malicious sites.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it requires network access, low effort, and allows attackers to execute arbitrary code with high confidentiality, integrity, and availability impact.
What to do about it
- 01Upgrade Cal.com to version 4.7.16 or later.
- 02Restart the Cal.com service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.