External risk intelligence

Cal.com Cal.diy Stored Cross-Site Scripting in BookingPageTagManager Analytics Tracking ID

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57858

The vulnerability exists in a booking page component designed for public-facing use. Because this is a web-based scheduling application where booking pages are intentionally exposed to the internet to receive visitor traffic, the affected component is public-facing by design in normal operations.

Cross-site Scripting

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Cal.com's booking pages may allow authenticated users to inject malicious code, potentially leading to unauthorized actions or data exposure for visitors of those pages. The main concern is confirming relevance and exposure.

Malicious code can run on visitor browsers.
It impacts public-facing booking pages.
Confirm if our booking pages are affected.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to an event can inject malicious JavaScript into a booking page by providing a crafted analytics tracking ID. This script then executes in the browsers of visitors to the public booking page, potentially allowing the attacker to steal session cookies, forge requests, or spread the attack to other events.

Authenticated event owner access required.
Inject JavaScript via analytics tracking ID.
Steal cookies, forge requests, propagate.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact users who visit public booking pages on affected Cal.com Cal.diy instances. Authenticated event owners could inject malicious JavaScript into the booking page via a crafted analytics tracking ID. This script could then execute in the browsers of visitors, potentially leading to session cookie theft or the creation of fraudulent requests.

Public booking pages are at risk.
Malicious script injection via tracking ID.
Session hijacking and forged requests.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership likely falls to the application team managing Cal.com/Cal.diy and potentially the platform team if Cal.diy is a managed service. The first practical step is to identify all Cal.diy instances, confirm their public reachability and business criticality, and then engage the accountable owner to plan remediation.

Application and platform teams own the fix.
Verify public booking page reachability.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com Cal.diy?

Cal.com Cal.diy is an open-source scheduling infrastructure platform that allows users to create customizable booking pages. It is commonly used by businesses and individuals to manage appointments by enabling external visitors to view availability and schedule time directly through a web interface.

What does CVE-2026-57858 mean for security?

This vulnerability is a stored cross-site scripting (XSS) flaw, categorized as CWE-79. It occurs when an application saves untrusted input—in this case, a tracking ID—without cleaning it first. Because the data is saved and then rendered on a page, the application essentially helps execute malicious code whenever someone visits that booking page.

How does an attacker trigger this issue?

An attacker needs authenticated access as an event owner to modify the analytics tracking ID for their booking page. Simply visiting the page as a guest does not trigger the bug; the malicious payload must be intentionally injected into the settings by someone with event management privileges.

Who should be concerned about this CVE?

Anyone running an affected version of Cal.diy should pay attention. According to Halo Surface Signal, this component is designed for public-facing use, meaning your booking pages are likely already exposed to the internet to receive visitor traffic, increasing the likelihood that a malicious script could impact your users.

How do I start addressing this vulnerability?

Begin by identifying all deployed instances of Cal.diy within your environment. Once you have a list, verify which ones are configured with public-facing booking pages and coordinate with your application or platform teams to plan for the necessary updates to remove this vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.