Is CVE-2024-58354 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58354 being exploited in the wild.

How severe is CVE-2024-58354?

Critical severity, with a CVSS score of 9.9, published 23 July 2026.

Is there a fix for CVE-2024-58354?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-58354 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2024-58354?

Check whether you run Cal.Com. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58354: Calcom cal.diy repository takeover via GitHub Actions pull_request_target

CVE-2024-58354 · Severity: critical · CVSS 9.9 · Published 2026-07-23

Cal.com (cal.diy) is an open-source scheduling platform. A security flaw in its automated code-testing system allows an attacker to take control of the project's source code repository. By submitting a malicious pull request, an attacker can execute unauthorized commands that allow them to modify code, delete branches, or tamper with the software's development history.

Technologies: Cal.Com. Vendors: Cal.com.

Quick answers

Is CVE-2024-58354 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58354 being exploited in the wild.
How severe is CVE-2024-58354?: Critical severity, with a CVSS score of 9.9, published 23 July 2026.
Which products and versions are affected?: calcom cal.diy main branch.
Is there a fix for CVE-2024-58354?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-58354 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-58354?: Check whether you run Cal.Com. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the GitHub Actions workflow 'pr.yml' which utilizes the 'pull_request_target' trigger. This trigger runs in the context of the base repository with default write permissions. The workflow passes these permissions to 'check-types.yml', which performs a checkout of untrusted code from the attacker's pull request using a 'dangerous-git-checkout' action. Subsequently, the workflow executes 'yarn install' and scripts from the attacker-controlled 'package.json'. An attacker with a GitHub account can trigger this by opening a pull request, gaining access to a write-scoped GITHUB_TOKEN. This allows for arbitrary command execution and full repository compromise, including pushing commits and merging malicious code.

Affected products

calcom cal.diy main branch

Timeline

2024-04-08: advisory: GitHub Security Advisory GHSA-p3f6-52gv-cj7m published
2026-07-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.