Executive brief
Cal.com (cal.diy) is an open-source scheduling platform. A security flaw in its automated code-testing system allows an attacker to take control of the project's source code repository. By submitting a malicious pull request, an attacker can execute unauthorized commands that allow them to modify code, delete branches, or tamper with the software's development history.
Technical details
The vulnerability exists in the GitHub Actions workflow 'pr.yml' which utilizes the 'pull_request_target' trigger. This trigger runs in the context of the base repository with default write permissions. The workflow passes these permissions to 'check-types.yml', which performs a checkout of untrusted code from the attacker's pull request using a 'dangerous-git-checkout' action. Subsequently, the workflow executes 'yarn install' and scripts from the attacker-controlled 'package.json'. An attacker with a GitHub account can trigger this by opening a pull request, gaining access to a write-scoped GITHUB_TOKEN. This allows for arbitrary command execution and full repository compromise, including pushing commits and merging malicious code.
Affected products
- calcom cal.diy main branch
Timeline
- 2024-04-08: advisory: GitHub Security Advisory GHSA-p3f6-52gv-cj7m published
- 2026-07-23: disclosed: NVD publication date