Executive brief
Cal.com is an open-source scheduling platform used to manage appointments and bookings. A security flaw in the booking page allows attackers to inject malicious scripts into booking question labels. If a victim visits a compromised booking link, the attacker could steal sensitive information, such as user data or API keys, potentially leading to account takeover or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Cal.com (cal.diy) versions <= 4.7.15 due to the use of React's 'dangerouslySetInnerHTML' attribute for rendering booking question labels without adequate sanitization or a Content Security Policy (CSP). An attacker with the ability to create event types (low privileges) can craft a malicious label containing arbitrary HTML or JavaScript. When a victim navigates to the publicly accessible booking view URL (/booking/<id>), the payload executes in the context of the victim's browser. This can lead to the theft of session cookies, local storage data, or API keys. The vulnerability is particularly critical for self-hosted instances with open registration. The issue is resolved in version 4.7.16.
Affected products
- Cal.com cal.diy <= 4.7.15
Timeline
- 2024-12-03: disclosed: Vulnerability reported by researcher xyzeva
- 2024-12-04: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: NVD publication date