External risk intelligence

Cal.com Booking View Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2024-58353

The vulnerability exists in the publicly accessible booking view of the application. As this is a scheduling platform designed to be shared with external users to book appointments, the affected surface is public-facing by design and intended for open internet access.

Cross-site Scripting

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a cross-site scripting vulnerability within the Cal.com booking system, specifically affecting how booking questions are displayed on publicly accessible single booking pages. Maliciously crafted question labels could allow an attacker to inject harmful code, potentially executing arbitrary scripts when a victim accesses the booking link. This poses a risk to self-hosted instances with open registration.

Attackers can inject code through booking questions.
Matters because it impacts public booking pages.
Confirm relevance and exposure of booking pages.

Attack Path

How an attacker could exploit the issue

An attacker could start by creating an event type with a specially crafted booking question label. This malicious label would then be displayed on the publicly accessible single booking view when a victim visits the booking URL. The vulnerability lies in how the booking question is rendered, allowing injected code to execute within the victim's browser.

Requires authenticated access to create an event type.
Victim visits a booking URL.
Arbitrary code execution in victim's browser.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious HTML or JavaScript into booking question labels on publicly accessible booking pages. When a user visits a booking page with a specially crafted label, the injected code could execute in their browser, potentially leading to session hijacking or the exposure of sensitive information. This risk is higher on self-hosted instances that allow open registration.

User booking data could be exposed.
Malicious script executes via booking links.
Session data may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

For self-hosted Cal.com instances, the application owner or platform team is primarily responsible for addressing this cross-site scripting vulnerability. The initial step involves identifying all deployed instances, confirming their internet reachability and business criticality. Once identified, the accountable owner must be located to plan remediation, which may involve vendor coordination if the instance is managed by a third party.

Application owners should prioritize remediation.
Verify internet-facing instances and business impact.
Plan updates with vendor or internal teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com?

Cal.com is an open-source scheduling infrastructure platform used to manage calendars and coordinate meetings. It allows users to create booking pages that others can visit to schedule appointments. The software provides a modular interface for defining event types and custom booking forms, which this vulnerability specifically impacts.

What is the vulnerability in CVE-2024-58353?

This vulnerability is a Cross-Site Scripting (XSS) flaw, categorized under CWE-80. It occurs because the application uses a function that renders raw HTML for booking question labels without proper sanitization. This allows malicious code to be embedded directly into a form field, which then executes unexpectedly in the browser of any user who loads that specific booking page.

How does an attacker trigger this XSS bug?

An attacker must first have the ability to create or modify an event type within the system, as they need to inject their malicious script into a booking question label. This does not trigger if the input is simply saved in the database; it only executes when a victim subsequently visits the specific, public-facing URL associated with that booking event.

Is my Cal.com instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant because the affected booking view is designed to be public-facing and accessible over the internet. If you host an instance where event creation is permitted—especially those with open registration—your users are at higher risk of encountering malicious scripts on these public pages.

How do I address this CVE-2024-58353 risk?

If you are running a self-hosted instance, you should immediately update your software to version 4.7.16 or later to apply the fix. Begin by auditing your environment to locate all active deployments, verify if they are internet-facing, and coordinate with your internal teams to ensure the update is applied to all affected instances.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.