CVE-2024-58353

Received Received - Intake

Cross-Site Scripting in Cal.com Booking View

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2024-58353

Affected Vendors & Products

Vendor	Product	Version / Range
calcom	cal	to 4.7.15 (inc)
calcom	cal	4.7.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

Cal.com versions <= 4.7.15 have a cross-site scripting (XSS) vulnerability in the single booking view page. Attackers can inject malicious HTML or JavaScript via booking question labels, which execute when victims visit the booking URL. The issue occurs because React's dangerouslySetInnerHTML is used without proper sanitization or Content Security Policy (CSP).

Detection Guidance

To detect this XSS vulnerability in Cal.com versions <= 4.7.15, inspect the booking question labels in the single booking view (e.g., /booking/<id>). Check if labels are rendered unsafely via React's dangerouslySetInnerHTML without proper sanitization. Manually test by creating an event with a malicious label containing JavaScript payloads.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect victims to malicious sites. Self-hosted instances with open registration are at higher risk as attackers can create malicious event types. The impact includes data theft, account compromise, and potential malware delivery.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines, legal liabilities, and reputational damage due to non-compliance.

Mitigation Strategies

Upgrade Cal.com to version 4.7.16 or later immediately. If upgrading is not possible, disable public event creation or restrict registration to trusted users. Implement strict Content Security Policy (CSP) headers to mitigate XSS impact. Review and sanitize all booking question labels for malicious content.

Hi! I’m here to help you understand CVE-2024-58353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70