# CVE-2024-58353: Cal.com cal.diy stored XSS in booking question labels

Source: https://junglewise.ai/threats/cve-2024-58353-cal-com-cal-diy-stored-xss-in-booking-question-labels  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2024-58353 · Severity: high · CVSS 8.9 · Published 2026-07-23

Cal.com is an open-source scheduling platform used to manage appointments and bookings. A security flaw in the booking page allows attackers to inject malicious scripts into booking question labels. If a victim visits a compromised booking link, the attacker could steal sensitive information, such as user data or API keys, potentially leading to account takeover or data theft.

Technologies: [Cal.Com](https://junglewise.ai/threats/technologies/cal-com). Vendors: [Cal.com](https://junglewise.ai/threats/vendors/cal-com).

## Quick answers

**Is CVE-2024-58353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-58353 being exploited in the wild.

**How severe is CVE-2024-58353?** High severity, with a CVSS score of 8.9, published 23 July 2026.

**Which products and versions are affected?** Cal.Com <= 4.7.15.

**Is there a fix for CVE-2024-58353?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-58353 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-58353?** Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Cal.com (cal.diy) versions <= 4.7.15 due to the use of React's 'dangerouslySetInnerHTML' attribute for rendering booking question labels without adequate sanitization or a Content Security Policy (CSP). An attacker with the ability to create event types (low privileges) can craft a malicious label containing arbitrary HTML or JavaScript. When a victim navigates to the publicly accessible booking view URL (/booking/<id>), the payload executes in the context of the victim's browser. This can lead to the theft of session cookies, local storage data, or API keys. The vulnerability is particularly critical for self-hosted instances with open registration. The issue is resolved in version 4.7.16.

## Affected products

- Cal.com cal.diy <= 4.7.15

## Timeline

- 2024-12-03: disclosed: Vulnerability reported by researcher xyzeva
- 2024-12-04: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: NVD publication date

## References

- [https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def](https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def)
- [https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8](https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8)
- [https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions](https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions)

## Related threats

- [Cal.com authorization bypass in webhook handler](https://junglewise.ai/threats/cve-2026-112043-a-weakness-has-been-identified-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com credentials delete cross-team privilege escalation](https://junglewise.ai/threats/cve-2026-109143-a-vulnerability-was-determined-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com remote code execution via Next.js RSC deserialization](https://junglewise.ai/threats/cve-2025-71389-cal-com-remote-code-execution-via-next-js-rsc-deserialization)
- [Cal.com stored XSS in booking question labels](https://junglewise.ai/threats/cve-2024-58355-cal-com-stored-xss-in-booking-question-labels)
- [Calcom cal.diy repository takeover via GitHub Actions pull_request_target](https://junglewise.ai/threats/cve-2024-58354-calcom-cal-diy-repository-takeover-via-github-actions-pull)