Cal.com - CraftedSignal Threat Feed

Cal.com Stored Cross-Site Scripting Vulnerability (CVE-2024-58355)

hello@craftedsignal.io — Thu, 23 Jul 2026 22:23:06 +0000

Cal.com (calcom/cal.diy) versions through 4.7.15 are affected by a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2024-58355. This flaw stems from improper sanitization of user-supplied input when rendering booking-question field labels via React's dangerouslySetInnerHTML function within the single booking view (e.g., https://app.cal.com/booking/). An attacker with the ability to create an event type can craft a malicious booking-question label containing arbitrary HTML or JavaScript. When a victim subsequently accesses the specially crafted booking URL, the embedded script executes in their browser context. This client-side code execution can lead to various malicious activities, including session hijacking, data exfiltration, or defacement of the victim's browser session. The vulnerability was discovered and subsequently patched in Cal.com version 4.7.16, making an update critical for all affected instances.

Attack Chain

An attacker creates a new event type within the vulnerable Cal.com application.
During the event type creation, the attacker embeds malicious HTML or JavaScript code into the booking-question label field.
The Cal.com application stores this unsanitized malicious payload in its database.
The attacker shares the URL to the crafted single booking view (e.g., https://app.cal.com/booking/) with a target victim.
The victim navigates to the provided booking URL in their web browser.
The Cal.com application retrieves the stored, malicious booking-question label and renders it on the page using React's dangerouslySetInnerHTML without proper sanitization.
The embedded arbitrary HTML or JavaScript code executes within the victim's browser context.
The attacker's script performs actions such as stealing session cookies, redirecting the user, or defacing the webpage, achieving impact.

Impact

Successful exploitation of CVE-2024-58355 allows for client-side code execution in the context of the victim's browser session. This can lead to a range of severe consequences for individual users and potentially the organization using Cal.com. Attackers can hijack user sessions, gaining unauthorized access to their Cal.com accounts or other services if single sign-on is used. Sensitive data, including personal information or meeting details, could be exfiltrated to attacker-controlled infrastructure. Additionally, the attacker could deface the web interface, perform phishing attacks, or redirect users to malicious websites, undermining user trust and the integrity of the Cal.com platform.

Recommendation

Patch CVE-2024-58355 immediately by upgrading all Cal.com instances to version 4.7.16 or newer.
Implement a Web Application Firewall (WAF) to detect and block common XSS payloads in HTTP request parameters, specifically those targeting input fields that could be rendered unsanitized, even though this is a stored XSS, WAFs can add a layer of protection during initial payload submission.
Review web server access logs for requests related to event creation or booking configurations (/booking/) that contain unusual characters or script patterns in query strings or post bodies, indicating potential XSS payload attempts.

CVE-2024-58353: Cal.com Cross-Site Scripting Vulnerability

hello@craftedsignal.io — Thu, 23 Jul 2026 22:22:23 +0000

Cal.com, specifically the calcom/cal.diy repository, contains a critical cross-site scripting (XSS) vulnerability, identified as CVE-2024-58353, affecting versions up to and including 4.7.15. This vulnerability allows an unauthenticated attacker to inject arbitrary HTML and JavaScript code into "booking question label" fields. The application then renders this unsanitized input via React's dangerouslySetInnerHTML on publicly accessible single booking views (e.g., /booking/). When a victim user visits a malicious booking view URL, the injected script executes in their browser context. This client-side code execution can lead to session hijacking, defacement, or redirection, posing a significant risk, especially for self-hosted Cal.com instances with open registration. The issue is resolved in version 4.7.16.

Attack Chain

An attacker identifies a vulnerable Cal.com instance (version <= 4.7.15).
The attacker registers or gains access to create new event types within the Cal.com instance.
During the creation or modification of an event type, the attacker crafts a malicious payload (e.g., or a more sophisticated script) and inputs it into a "booking question label" field.
The Cal.com application stores this malicious content in its database without adequately sanitizing the input.
The attacker then obtains the URL for the publicly accessible single booking view associated with the compromised event type (e.g., /booking/).
The attacker distributes this malicious booking view URL to a victim, typically via social engineering or a direct link.
When the victim visits the provided booking view URL, the Cal.com application fetches the stored malicious "booking question label."
The application renders the page using React's dangerouslySetInnerHTML method, which directly embeds the unsanitized malicious HTML/JavaScript into the victim's browser, leading to client-side code execution.

Impact

Successful exploitation of CVE-2024-58353 allows attackers to execute arbitrary HTML and JavaScript in the context of the victim's browser. The direct consequences can include session hijacking, enabling attackers to impersonate the victim, or website defacement. More advanced attacks could involve redirecting users to malicious sites, stealing sensitive data (e.g., cookies, local storage), or performing actions on behalf of the victim through their authenticated session. Self-hosted Cal.com instances with open registration are particularly vulnerable due to the ease with which attackers can create malicious event types.

Recommendation

Upgrade Cal.com instances to version 4.7.16 or later immediately to patch CVE-2024-58353.
Implement Content Security Policy (CSP) headers across all web applications to mitigate the impact of XSS vulnerabilities by restricting script sources.
Ensure proper input validation and output encoding are enforced for all user-supplied data in web applications, especially in fields like the "booking question label" mentioned in the CVE-2024-58353 description.

Repository Takeover Vulnerability in cal.com GitHub Actions (CVE-2024-58354)

hello@craftedsignal.io — Thu, 23 Jul 2026 22:20:33 +0000

A critical repository takeover vulnerability, identified as CVE-2024-58354, affects the cal.com (specifically the calcom repository, later renamed cal.diy) project's GitHub Actions workflows. Attackers can exploit this by submitting a specially crafted pull request. The vulnerable pr.yml workflow, triggered by pull_request_target events, inadvertently grants its default write permissions (via the GITHUB_TOKEN) to a downstream workflow, check-types.yml. This check-types.yml then utilizes a "dangerous" checkout action to retrieve the attacker's submitted pull request code and subsequently executes it through yarn install and package.json scripts. This execution takes place with the repository's write-scoped token, enabling the attacker to perform arbitrary actions such as pushing commits, merging or mutating pull requests, adding or deleting comments, and deleting or force-pushing branches, effectively leading to a full compromise of the main branch and its associated codebase. No patched version is currently available for this vulnerability.

Attack Chain

An attacker crafts a malicious pull request containing arbitrary commands within package.json scripts.
The attacker submits this pull request to the vulnerable cal.com repository.
The pr.yml GitHub Actions workflow is triggered by the pull_request_target event.
The pr.yml workflow, by design, passes its default repository write permissions (via GITHUB_TOKEN) to the check-types.yml workflow.
The check-types.yml workflow uses a "dangerous" checkout action to fetch the attacker's malicious pull request code.
check-types.yml executes yarn install and subsequent package.json scripts from the attacker-controlled code.
The attacker's arbitrary commands are executed with the repository's write-scoped GITHUB_TOKEN.
The attacker gains full control over the repository, capable of pushing commits, merging pull requests, and manipulating branches, leading to a complete repository compromise.

Impact

The successful exploitation of CVE-2024-58354 results in a complete repository takeover for the affected cal.com GitHub repository. Attackers can gain the ability to inject malicious code, tamper with the software supply chain, delete or alter source code, and potentially compromise the integrity of releases. This could lead to backdoored software distributed to users, data exfiltration from the repository, or disruption of development workflows. As the main branch is affected and no patch is available, the risk remains high for organizations using or contributing to the cal.com project.

Recommendation

Review all GitHub Actions workflows, particularly pr.yml and check-types.yml, for the use of pull_request_target in conjunction with write permissions and dangerous checkout actions as described in CVE-2024-58354.
Disable or refactor GitHub Actions workflows that use pull_request_target with default write permissions and perform untrusted code execution to mitigate CVE-2024-58354.
Implement "least privilege" for GitHub Actions workflows, explicitly limiting permissions for GITHUB_TOKEN rather than relying on default write permissions.
Audit existing GitHub Actions workflow logs for any suspicious activity or unexpected command execution that could indicate prior exploitation of CVE-2024-58354.