CVE-2024-58355

Received Received - Intake

Stored XSS in Cal.com Booking System

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2024-58355

Affected Vendors & Products

Vendor	Product	Version / Range
calcom	cal	to 4.7.15 (inc)
calcom	cal	4.7.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

Cal.com versions through 4.7.15 have a stored cross-site scripting (XSS) vulnerability. The single booking view renders booking-question field labels using React's dangerouslySetInnerHTML without sanitizing user input. An attacker can create an event type with a malicious booking-question label to inject arbitrary HTML or JavaScript. This executes when a victim opens the crafted booking URL. The issue is fixed in version 4.7.16.

Detection Guidance

To detect this vulnerability, inspect Cal.com instances for versions through 4.7.15. Check the booking-question field labels in event types for suspicious HTML/JavaScript content. Manually review single booking views (e.g., https://app.cal.com/booking/<id>) for unexpected script execution or injected content.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Victims opening a crafted booking URL may have their data compromised or browser sessions hijacked. The impact depends on user privileges and the sensitivity of data handled by Cal.com.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face fines, reputational damage, and legal consequences if exploited. Compliance with data protection laws could be compromised due to potential data breaches.

Mitigation Strategies

Upgrade Cal.com to version 4.7.16 or later immediately. Remove any event types with malicious booking-question labels. Implement input validation and output encoding for all user-supplied data in booking fields to prevent XSS attacks.

Hi! I’m here to help you understand CVE-2024-58355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70