Is CVE-2024-58353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58353 being exploited in the wild.

How severe is CVE-2024-58353?

High severity, with a CVSS score of 8.9, published 23 July 2026.

Is there a fix for CVE-2024-58353?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-58353 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-58353?

Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58353: Cal.com cal.diy stored XSS in booking question labels

CVE-2024-58353 · Severity: high · CVSS 8.9 · Published 2026-07-23

Cal.com is an open-source scheduling platform used to manage appointments and bookings. A security flaw in the booking page allows attackers to inject malicious scripts into booking question labels. If a victim visits a compromised booking link, the attacker could steal sensitive information, such as user data or API keys, potentially leading to account takeover or data theft.

Technologies: Cal.Com. Vendors: Cal.com.

Quick answers

Is CVE-2024-58353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58353 being exploited in the wild.
How severe is CVE-2024-58353?: High severity, with a CVSS score of 8.9, published 23 July 2026.
Which products and versions are affected?: Cal.Com <= 4.7.15.
Is there a fix for CVE-2024-58353?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-58353 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-58353?: Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Cal.com (cal.diy) versions <= 4.7.15 due to the use of React's 'dangerouslySetInnerHTML' attribute for rendering booking question labels without adequate sanitization or a Content Security Policy (CSP). An attacker with the ability to create event types (low privileges) can craft a malicious label containing arbitrary HTML or JavaScript. When a victim navigates to the publicly accessible booking view URL (/booking/<id>), the payload executes in the context of the victim's browser. This can lead to the theft of session cookies, local storage data, or API keys. The vulnerability is particularly critical for self-hosted instances with open registration. The issue is resolved in version 4.7.16.

Affected products

Cal.com cal.diy <= 4.7.15

Timeline

2024-12-03: disclosed: Vulnerability reported by researcher xyzeva
2024-12-04: advisory: GitHub Security Advisory published
2026-07-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.