CVE-2026-57858 cal.com Self-Hosted Stored XSS Vulnerability Analysis

CVE-2026-57858: cal.com Refuses to Patch Stored XSS Vulnerability in Self-Hosted Versions Vulnerability Overview Vulnerability Type: Stored XSS (Stored Cross-Site Scripting) Vulnerability ID: CVE-2026-57858 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation Severity: High Affected Component: (packages/app-store/BookingPageTagManager.tsx) Root Cause: The uses to inject user-controlled when constructing inline tags, without any escaping or filtering. Impact Scope Affected Versions: Cal.com self-hosted versions (cal.diy), tested version range from 2.1.1 (2022-10-24) to 6.2.0 (2026-03-01). Affected Users: All users accessing public booking pages provided by self-hosted instances. Potential Harm: - Theft of user cookies and session states. - Forced actions initiated via CSRF. - Execution of arbitrary JavaScript in the victim's browser. - Worm-like propagation when combined with CSRF. Remediation Official Status: As of August 7, 2026, Cal.com has not provided a fix, claiming this issue does not affect their SaaS instances. Temporary Mitigation (for self-hosted users): - Restrict or disable analytics integrations where possible. - Remove untrusted analytics tracking IDs. - Review stored analytics configurations. - Apply local patches to escape/filter tag manager values. - Verify the effectiveness of local mitigations. POC Code 1. Create Malicious Event Type In Cal.diy, create a new event type with the title and URL . 2. Install Analytics App In the event configuration, navigate to "Apps" and install an analytics app, such as Google Tag Manager. 3. Inject Malicious Payload Set the Google Tag Manager Tracking ID to the following Payload: 4. Trigger Vulnerability In another session, access the public booking page (e.g., ). 5. Observe Results The malicious JavaScript will execute in the visitor's browser, popping up a dialog containing the content of . 6. Source Code Verification The injected Payload can be seen in the page source code: ```html window.dataLayer = window.dataLayer window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window.dataLayer.push({ 'event': 'gtm.js', 'gtm.start': new Date().getTime(), 'gtm.url': location.href }); // ... other code ... window

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-57858 cal.com Self-Hosted Stored XSS Vulnerability Analysis