CVE-2024-58355
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability in the single booking view where booking‑question field labels are rendered via React's dangerouslySetInnerHTML without sanitization. An attacker who can create an event type with a malicious label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is resolved in version 4.7.16.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of Cal.com (calcom/cal.diy) versions 4.7.15 and earlier.
Real-world impact
An attacker could steal session cookies, perform actions on behalf of the user, or deface the booking page when the victim views a crafted booking link.
Why this severity
CVSS v4.0 base score 9.3 (Critical) due to network‑adjacent attack vector, low attack complexity, low privileges required, user interaction needed, and high impacts to confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade Cal.com (calcom/cal.diy) to version 4.7.16 or later.
NVD-referenced vendor advisory (fix version mentioned in NVD description)
Timeline
- Jul 23, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.