EUVD-2026-57195
GHSA-5m2w-xrqj-9hhh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network stored XSS needing a low-privilege event-owner (PR:L) and victim page load (UI:R); executes cross-context so scope changes (S:C), with cookie theft driving C:H and forged requests I:L, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
AnalysisAI
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account holding the event-owner role on an affected self-hosted Cal.com (Cal.diy) instance, versions 2.1.1-6.2.0, with the ability to set an event's analytics tracking ID through the BookingPageTagManager configuration - the malicious tracking ID IS the injection vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue rather than a paper-tiger high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so no fixed version can be cited; monitor the Cal.com repository (https://github.com/calcom/cal.com) and the VulnCheck advisory (https://www.vulncheck.com/advisories/cal-com-cal-diy-stored-xss-via-bookingpagetagmanager-analytics-tracking-id) for a tagged release and upgrade to it as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Cal.diy deployments in use and document their versions; restrict event owner account access to essential personnel only; enable logging and monitoring for event configuration changes and public booking page access anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today