Skip to content
Threat Feed
Subscribe

Tag

DangerouslySetInnerHTML

1 brief RSS
critical advisory

CVE-2024-58353: Cal.com Cross-Site Scripting Vulnerability

CVE-2024-58353 describes a cross-site scripting (XSS) vulnerability in Cal.com (repository calcom/cal.diy) versions up to and including 4.7.15, where an attacker can inject malicious HTML/JavaScript into booking question labels that is then executed via React's dangerouslySetInnerHTML when a victim visits a publicly accessible single booking view, allowing for arbitrary client-side code execution, particularly impacting self-hosted instances with open registration.

Cal.com xss web-vulnerability react dangerouslySetInnerHTML
1t 1c