CVE-2026-57858
Received Received - Intake

Stored XSS in Cal.com Cal.diy Booking Page

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-57858
EUVD
EUVD-2026-57195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cal.com cal.diy From 2.1.1 (inc) to 6.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57858 is a stored cross-site scripting (XSS) vulnerability in Cal.com Cal.diy versions 2.1.1 through 6.2.0. It allows authenticated event owners to inject malicious JavaScript via the analytics tracking ID field without sanitization. The payload executes in visitors' browsers on public booking pages, enabling session theft, forged requests, and potential wormable spread by chaining with CSRF endpoints.

Detection Guidance

To detect this vulnerability, inspect the analytics tracking ID field in your Cal.diy admin panel for suspicious payloads. Check public booking pages for unexpected JavaScript execution or unusual inline scripts. Review server logs for requests containing XSS payloads in the tracking ID parameter.

Impact Analysis

If you use Cal.diy versions 2.1.1-6.2.0, attackers could steal your session cookies, perform actions on your behalf, or spread malware to other users via your booking pages. Self-hosted users are at risk if they use analytics integrations with untrusted tracking IDs.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches if user data is compromised through this XSS flaw.

Mitigation Strategies

Disable all analytics integrations in Cal.diy immediately. Review and remove any malicious tracking IDs. Apply local input sanitization patches to the BookingPageTagManager component. Monitor public booking pages for signs of exploitation and restrict event owner permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart