CyberRota Analysis
AI-GeneratedVersions of Cal.com up to 4.7.15 are vulnerable to a stored cross-site scripting (XSS) flaw, allowing attackers to inject malicious HTML or JavaScript into booking-question field labels. This vulnerability can lead to the execution of arbitrary code when a victim accesses a crafted booking URL, posing a significant risk to users. Organizations utilizing affected versions should prioritize updating to v4.7.16 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.