PT-2026-64179 · Cal.Com · Cal.Com

Xyzeva · CVE-2024-58353 · Published 2026-07-23 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16

Description Cross-site scripting (XSS) occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels without proper input sanitization or a Content Security Policy (CSP). This allows an attacker to create an event type with a malicious label to inject arbitrary HTML or JavaScript, which executes when a victim visits the booking URL. Self-hosted instances with open registration are especially susceptible.

Recommendations Update to version 4.7.16.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-58353

GHSA-VGJ7-76CW-H6F8

Affected Products

Cal.Com

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58353.json · Exploit
• https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8 · Vendor Advisory
• https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-58353 · Security Note
• https://osv.dev/vulnerability/CVE-2024-58353 · Vendor Advisory
• https://vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions · Note