Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-58354— cal.com Repository Takeover via pull_request_target Workflow

Quick assessment

Affected
calcom cal.diy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

calcom cal.diy是calcom的Web中间件。 calcom cal.diy存在命令注入漏洞，该漏洞源于GitHub Actions工作流中pull_request_target触发器的使用，导致攻击者可以通过打开拉取请求运行任意命令，利用仓库的写入权限，进行提交、合并或修改拉取请求、添加或删除评论以及删除或强制推送分支，从而接管仓库。

CVSS 9.9 · Critical EPSS 0.56% · P44

Affected Version Matrix 1

VendorProduct Version RangeStatus
calcom cal.diy any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-58354

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cal.com Repository Takeover via pull_request_target Workflow
Source: CVE Program / CVE List V5
Vulnerability Description
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git-checkout action) and subsequently executes it (through yarn install and package.json scripts). An attacker can open a pull request whose code runs arbitrary commands with the repository's write-scoped GITHUB_TOKEN, allowing them to push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches, thereby compromising the repository. The main branch is affected; no patched version is available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
calcom cal.diy 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
calcom cal.diy是calcom的Web中间件。 calcom cal.diy存在命令注入漏洞，该漏洞源于GitHub Actions工作流中pull_request_target触发器的使用，导致攻击者可以通过打开拉取请求运行任意命令，利用仓库的写入权限，进行提交、合并或修改拉取请求、添加或删除评论以及删除或强制推送分支，从而接管仓库。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
calcom cal.diy - -

II. Public POCs for CVE-2024-58354

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-58354

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-58354 (2)

Same Patch Batch · calcom · 2026-07-23 · 4 CVEs total

CVE-2025-71389 10.0 CRITICAL Cal.com before 5.9.9 Remote Code Execution via RSC
CVE-2024-58355 8.9 HIGH Cal.com through 4.7.15 Cross-Site Scripting via booking questions
CVE-2024-58353 8.9 HIGH Cal.com through 4.7.15 Cross-Site Scripting via booking questions

IV. Related Vulnerabilities

Same product: cal.diy
Same vendor: calcom
Same weakness: CWE-77

V. Comments for CVE-2024-58354

No comments yet

Leave a comment