{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/cal.com/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.9,"id":"CVE-2024-58355"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cal.com (\u003c 4.7.16)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","client-side-execution"],"_cs_type":"advisory","_cs_vendors":["Cal.com"],"content_html":"\u003cp\u003eCal.com (calcom/cal.diy) versions through 4.7.15 are affected by a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2024-58355. This flaw stems from improper sanitization of user-supplied input when rendering booking-question field labels via React's \u003ccode\u003edangerouslySetInnerHTML\u003c/code\u003e function within the single booking view (e.g., \u003ccode\u003ehttps://app.cal.com/booking/\u0026lt;id\u0026gt;\u003c/code\u003e). An attacker with the ability to create an event type can craft a malicious booking-question label containing arbitrary HTML or JavaScript. When a victim subsequently accesses the specially crafted booking URL, the embedded script executes in their browser context. This client-side code execution can lead to various malicious activities, including session hijacking, data exfiltration, or defacement of the victim's browser session. The vulnerability was discovered and subsequently patched in Cal.com version 4.7.16, making an update critical for all affected instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker creates a new event type within the vulnerable Cal.com application.\u003c/li\u003e\n\u003cli\u003eDuring the event type creation, the attacker embeds malicious HTML or JavaScript code into the booking-question label field.\u003c/li\u003e\n\u003cli\u003eThe Cal.com application stores this unsanitized malicious payload in its database.\u003c/li\u003e\n\u003cli\u003eThe attacker shares the URL to the crafted single booking view (e.g., \u003ccode\u003ehttps://app.cal.com/booking/\u0026lt;id\u0026gt;\u003c/code\u003e) with a target victim.\u003c/li\u003e\n\u003cli\u003eThe victim navigates to the provided booking URL in their web browser.\u003c/li\u003e\n\u003cli\u003eThe Cal.com application retrieves the stored, malicious booking-question label and renders it on the page using React's \u003ccode\u003edangerouslySetInnerHTML\u003c/code\u003e without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe embedded arbitrary HTML or JavaScript code executes within the victim's browser context.\u003c/li\u003e\n\u003cli\u003eThe attacker's script performs actions such as stealing session cookies, redirecting the user, or defacing the webpage, achieving impact.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-58355 allows for client-side code execution in the context of the victim's browser session. This can lead to a range of severe consequences for individual users and potentially the organization using Cal.com. Attackers can hijack user sessions, gaining unauthorized access to their Cal.com accounts or other services if single sign-on is used. Sensitive data, including personal information or meeting details, could be exfiltrated to attacker-controlled infrastructure. Additionally, the attacker could deface the web interface, perform phishing attacks, or redirect users to malicious websites, undermining user trust and the integrity of the Cal.com platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2024-58355 immediately by upgrading all Cal.com instances to version 4.7.16 or newer.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to detect and block common XSS payloads in HTTP request parameters, specifically those targeting input fields that could be rendered unsanitized, even though this is a stored XSS, WAFs can add a layer of protection during initial payload submission.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests related to event creation or booking configurations (\u003ccode\u003e/booking/\u0026lt;id\u0026gt;\u003c/code\u003e) that contain unusual characters or script patterns in query strings or post bodies, indicating potential XSS payload attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T22:23:06Z","date_published":"2026-07-23T22:23:06Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2024-58355-calcom-xss/","summary":"A stored cross-site scripting (XSS) vulnerability, CVE-2024-58355, affects Cal.com (calcom/cal.diy) versions through 4.7.15, allowing an attacker to inject arbitrary HTML/JavaScript into a booking-question label that executes in a victim's browser when they view a crafted booking URL, potentially leading to session hijacking, data theft, or defacement.","title":"Cal.com Stored Cross-Site Scripting Vulnerability (CVE-2024-58355)","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2024-58355-calcom-xss/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.9,"id":"CVE-2024-58353"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cal.com (repository calcom/cal.diy) \u003c= 4.7.15"],"_cs_severities":["critical"],"_cs_tags":["xss","web-vulnerability","react","dangerouslySetInnerHTML"],"_cs_type":"advisory","_cs_vendors":["Cal.com"],"content_html":"\u003cp\u003eCal.com, specifically the \u003ccode\u003ecalcom/cal.diy\u003c/code\u003e repository, contains a critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-58353, affecting versions up to and including 4.7.15. This vulnerability allows an unauthenticated attacker to inject arbitrary HTML and JavaScript code into \u0026quot;booking question label\u0026quot; fields. The application then renders this unsanitized input via React's \u003ccode\u003edangerouslySetInnerHTML\u003c/code\u003e on publicly accessible single booking views (e.g., \u003ccode\u003e/booking/\u0026lt;id\u0026gt;\u003c/code\u003e). When a victim user visits a malicious booking view URL, the injected script executes in their browser context. This client-side code execution can lead to session hijacking, defacement, or redirection, posing a significant risk, especially for self-hosted Cal.com instances with open registration. The issue is resolved in version 4.7.16.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a vulnerable Cal.com instance (version \u0026lt;= 4.7.15).\u003c/li\u003e\n\u003cli\u003eThe attacker registers or gains access to create new event types within the Cal.com instance.\u003c/li\u003e\n\u003cli\u003eDuring the creation or modification of an event type, the attacker crafts a malicious payload (e.g., \u003ccode\u003e\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;\u003c/code\u003e or a more sophisticated script) and inputs it into a \u0026quot;booking question label\u0026quot; field.\u003c/li\u003e\n\u003cli\u003eThe Cal.com application stores this malicious content in its database without adequately sanitizing the input.\u003c/li\u003e\n\u003cli\u003eThe attacker then obtains the URL for the publicly accessible single booking view associated with the compromised event type (e.g., \u003ccode\u003e/booking/\u0026lt;id\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker distributes this malicious booking view URL to a victim, typically via social engineering or a direct link.\u003c/li\u003e\n\u003cli\u003eWhen the victim visits the provided booking view URL, the Cal.com application fetches the stored malicious \u0026quot;booking question label.\u0026quot;\u003c/li\u003e\n\u003cli\u003eThe application renders the page using React's \u003ccode\u003edangerouslySetInnerHTML\u003c/code\u003e method, which directly embeds the unsanitized malicious HTML/JavaScript into the victim's browser, leading to client-side code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-58353 allows attackers to execute arbitrary HTML and JavaScript in the context of the victim's browser. The direct consequences can include session hijacking, enabling attackers to impersonate the victim, or website defacement. More advanced attacks could involve redirecting users to malicious sites, stealing sensitive data (e.g., cookies, local storage), or performing actions on behalf of the victim through their authenticated session. Self-hosted Cal.com instances with open registration are particularly vulnerable due to the ease with which attackers can create malicious event types.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cal.com instances to version 4.7.16 or later immediately to patch CVE-2024-58353.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers across all web applications to mitigate the impact of XSS vulnerabilities by restricting script sources.\u003c/li\u003e\n\u003cli\u003eEnsure proper input validation and output encoding are enforced for all user-supplied data in web applications, especially in fields like the \u0026quot;booking question label\u0026quot; mentioned in the CVE-2024-58353 description.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T22:22:23Z","date_published":"2026-07-23T22:22:23Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2024-58353-calcom-xss/","summary":"CVE-2024-58353 describes a cross-site scripting (XSS) vulnerability in Cal.com (repository calcom/cal.diy) versions up to and including 4.7.15, where an attacker can inject malicious HTML/JavaScript into booking question labels that is then executed via React's dangerouslySetInnerHTML when a victim visits a publicly accessible single booking view, allowing for arbitrary client-side code execution, particularly impacting self-hosted instances with open registration.","title":"CVE-2024-58353: Cal.com Cross-Site Scripting Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2024-58353-calcom-xss/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2024-58354"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cal.com (calcom/cal.diy repository)","GitHub Actions"],"_cs_severities":["critical"],"_cs_tags":["github-actions","repository-takeover","vulnerability","cloud-security"],"_cs_type":"advisory","_cs_vendors":["cal.com","GitHub"],"content_html":"\u003cp\u003eA critical repository takeover vulnerability, identified as CVE-2024-58354, affects the cal.com (specifically the \u003ccode\u003ecalcom\u003c/code\u003e repository, later renamed \u003ccode\u003ecal.diy\u003c/code\u003e) project's GitHub Actions workflows. Attackers can exploit this by submitting a specially crafted pull request. The vulnerable \u003ccode\u003epr.yml\u003c/code\u003e workflow, triggered by \u003ccode\u003epull_request_target\u003c/code\u003e events, inadvertently grants its default write permissions (via the GITHUB_TOKEN) to a downstream workflow, \u003ccode\u003echeck-types.yml\u003c/code\u003e. This \u003ccode\u003echeck-types.yml\u003c/code\u003e then utilizes a \u0026quot;dangerous\u0026quot; checkout action to retrieve the attacker's submitted pull request code and subsequently executes it through \u003ccode\u003eyarn install\u003c/code\u003e and \u003ccode\u003epackage.json\u003c/code\u003e scripts. This execution takes place with the repository's write-scoped token, enabling the attacker to perform arbitrary actions such as pushing commits, merging or mutating pull requests, adding or deleting comments, and deleting or force-pushing branches, effectively leading to a full compromise of the main branch and its associated codebase. No patched version is currently available for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious pull request containing arbitrary commands within \u003ccode\u003epackage.json\u003c/code\u003e scripts.\u003c/li\u003e\n\u003cli\u003eThe attacker submits this pull request to the vulnerable cal.com repository.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epr.yml\u003c/code\u003e GitHub Actions workflow is triggered by the \u003ccode\u003epull_request_target\u003c/code\u003e event.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epr.yml\u003c/code\u003e workflow, by design, passes its default repository write permissions (via \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e) to the \u003ccode\u003echeck-types.yml\u003c/code\u003e workflow.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003echeck-types.yml\u003c/code\u003e workflow uses a \u0026quot;dangerous\u0026quot; checkout action to fetch the attacker's malicious pull request code.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003echeck-types.yml\u003c/code\u003e executes \u003ccode\u003eyarn install\u003c/code\u003e and subsequent \u003ccode\u003epackage.json\u003c/code\u003e scripts from the attacker-controlled code.\u003c/li\u003e\n\u003cli\u003eThe attacker's arbitrary commands are executed with the repository's write-scoped \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker gains full control over the repository, capable of pushing commits, merging pull requests, and manipulating branches, leading to a complete repository compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2024-58354 results in a complete repository takeover for the affected cal.com GitHub repository. Attackers can gain the ability to inject malicious code, tamper with the software supply chain, delete or alter source code, and potentially compromise the integrity of releases. This could lead to backdoored software distributed to users, data exfiltration from the repository, or disruption of development workflows. As the main branch is affected and no patch is available, the risk remains high for organizations using or contributing to the cal.com project.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview all GitHub Actions workflows, particularly \u003ccode\u003epr.yml\u003c/code\u003e and \u003ccode\u003echeck-types.yml\u003c/code\u003e, for the use of \u003ccode\u003epull_request_target\u003c/code\u003e in conjunction with write permissions and dangerous checkout actions as described in CVE-2024-58354.\u003c/li\u003e\n\u003cli\u003eDisable or refactor GitHub Actions workflows that use \u003ccode\u003epull_request_target\u003c/code\u003e with default write permissions and perform untrusted code execution to mitigate CVE-2024-58354.\u003c/li\u003e\n\u003cli\u003eImplement \u0026quot;least privilege\u0026quot; for GitHub Actions workflows, explicitly limiting permissions for GITHUB_TOKEN rather than relying on default write permissions.\u003c/li\u003e\n\u003cli\u003eAudit existing GitHub Actions workflow logs for any suspicious activity or unexpected command execution that could indicate prior exploitation of CVE-2024-58354.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T22:20:33Z","date_published":"2026-07-23T22:20:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-calcom-repo-takeover/","summary":"A critical repository takeover vulnerability (CVE-2024-58354) exists in the cal.com (calcom/cal.diy) GitHub Actions workflows, allowing an attacker to submit a malicious pull request that executes arbitrary commands with write permissions to the repository, leading to full compromise.","title":"Repository Takeover Vulnerability in cal.com GitHub Actions (CVE-2024-58354)","url":"https://feed.craftedsignal.io/briefs/2026-07-calcom-repo-takeover/"}],"language":"en","title":"CraftedSignal Threat Feed - Cal.com","version":"https://jsonfeed.org/version/1.1"}