CyberRota Analysis
AI-GeneratedVersions of Cal.com up to 4.7.15 are vulnerable to cross-site scripting (XSS) due to improper input sanitization in the booking question labels rendered on the public booking view. This flaw allows attackers to inject malicious HTML/JavaScript, potentially compromising user data and session integrity when victims access the affected URLs. Organizations using self-hosted instances with open registration should prioritize upgrading to version 4.7.16 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.