CVE-2026-57858

Name of the Vulnerable Software and Affected Versions Cal.com Cal.diy versions 2.1.1 through 6.2.0

Description A stored cross-site scripting issue exists in the BookingPageTagManager component. Authenticated event owners can inject arbitrary JavaScript by providing a malicious analytics tracking ID that is not properly sanitized. This allows an attacker to close the inline script string literal with a crafted payload, which then executes in the browser of any visitor to the public booking page. This can lead to session cookie theft, forged authenticated requests, and wormable propagation by chaining the attack with CSRF-able endpoints to persist payloads on other events. Cross-site scripting (XSS) is a flaw where malicious scripts are injected into trusted websites.

Recommendations Update Cal.com Cal.diy to a version later than 6.2.0.