EUVD-2026-57195
GHSA-5m2w-xrqj-9hhh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain event-owner account on Cal.diy
-
DeliverySet malicious analytics tracking ID
-
ExploitBreak out of inline script literal
-
ExecutionVisitor loads public booking page
-
PersistPayload steals cookies / forges requests
-
ImpactChain CSRF to persist on more events
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account holding the event-owner role on an affected self-hosted Cal.com (Cal.diy) instance, versions 2.1.1-6.2.0, with the ability to set an event's analytics tracking ID through the BookingPageTagManager configuration - the malicious tracking ID IS the injection vector. Exploitation of victims requires a visitor to load the affected public booking page (UI/interaction), which is the page's normal purpose and therefore a weak limiting factor. Limiting factors: the attacker must first obtain event-owner privileges (not fully unauthenticated), only self-hosted Cal.diy is affected (not necessarily the hosted service), and the instance must run a version in the 2.1.1-6.2.0 range with the vulnerable tracking-ID handling. |
| Impact | This is a genuinely high-priority issue rather than a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) shows a low-complexity, network-reachable attack requiring only a low-privileged, self-registerable role (an event owner) plus routine victim interaction of simply loading a booking page - a very low bar given booking pages are meant to be visited by strangers. The subsequent-system impact metrics (SC:H/SI:H) and the wormable/CSRF-chaining potential are what push real-world risk up, because a single malicious operator can affect all visitors and potentially cascade to other events. Tempering factors: no CISA KEV listing and no confirmed public PoC, so exploitation appears theoretical/targeted rather than mass-automated for now, and no vendor patch version is confirmed. Because self-hosted booking pages are public by design and the required privilege is trivially obtainable, any operator running an affected Cal.diy instance should treat this as urgent and prioritize an upgrade once a fixed release is confirmed. |
| Exploit ScenarioDerived | A low-privileged user registers or is granted an event-owner role on a self-hosted Cal.diy instance and sets an event's analytics tracking ID to a payload that closes the inline script string and appends JavaScript. When any visitor opens that public booking page, the script runs in their browser, exfiltrating session cookies and issuing forged authenticated requests; by targeting CSRF-able endpoints the payload can plant itself on additional events for wormable spread. A third-party write-up describing the technique exists, but no packaged public exploit is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
RemediationAI
No vendor-released patch version is identified in the available data, so no fixed version can be cited; monitor the Cal.com repository (https://github.com/calcom/cal.com) and the VulnCheck advisory (https://www.vulncheck.com/advisories/cal-com-cal-diy-stored-xss-via-bookingpagetagmanager-analytics-tracking-id) for a tagged release and upgrade to it as the primary fix. As compensating controls until a patch is confirmed: restrict who can create or own events (limit the low-privilege event-owner role to trusted users) to remove the injection avenue; audit and constrain the analytics tracking-ID field, rejecting or strictly allow-listing values to the exact format of legitimate tracking IDs (e.g., alphanumeric/hyphen patterns), which disables the analytics-integration flexibility for operators but closes the vector; and deploy a strict Content-Security-Policy that forbids inline script execution on booking pages, noting this may break legitimate inline analytics snippets and require refactoring to nonce/hash-based scripts. Rotating and hardening session cookies (HttpOnly, SameSite) reduces cookie-theft impact but does not stop forged in-page authenticated requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cal.com is an open-source scheduling/booking platform (a Calendly alternative); the affected surface is the self-hosted 'Cal.diy' distribution. The BookingPageTagManager component injects operator-supplied analytics tracking IDs (e.g., for Google Analytics/tag managers) directly into an inline <script> block on the public booking page. Because the value is placed inside a JavaScript string literal without escaping or sanitization, a crafted ID can terminate the string and append arbitrary statements - the classic improper-neutralization-of-input root cause described by CWE-79 (Cross-site Scripting). Since the script executes in every anonymous visitor's browser in the origin of the booking site, it inherits access to that origin's cookies and authenticated context.
Know when Cal Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Network stored XSS needing a low-privilege event-owner (PR:L) and victim page load (UI:R); executes cross-context so scope changes (S:C), with cookie theft driving C:H and forged requests I:L, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
Executive ViewAI
Cal.com (Cal.diy) versions 2.1.1-6.2.0 contain a critical stored XSS vulnerability in booking page analytics that allows authenticated event owners to inject malicious JavaScript executed for all public visitors. Attackers can steal session cookies, forge user actions, and propagate attacks across installations, exposing all organizations using affected versions and their end-users to account compromise and unauthorized activity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict event owner account privileges to trusted personnel; (2) deploy Content Security Policy headers to block inline script execution on booking pages; (3) implement WAF rules to sanitize tracking parameters; (4) disable public analytics features if operationally feasible; (5) establish continuous monitoring of event configuration changes and visitor access patterns; (6) conduct regular access reviews of all event owner accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
A remote code execution vulnerability in Cal.com (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerabi
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attacker
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege us
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable
Exploit-DB