CVE-2026-57858: Cal.com Cal.diy Stored XSS Vulnerability

CVE-2026-57858 Overview

CVE-2026-57858 is a stored cross-site scripting (XSS) vulnerability affecting Cal.com Cal.diy versions 2.1.1 through 6.2.0. The flaw resides in the BookingPageTagManager component, which accepts an analytics tracking ID from authenticated event owners without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page. Successful exploitation enables session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Any visitor loading a poisoned Cal.diy booking page executes attacker-controlled JavaScript, enabling account takeover and self-propagating payloads across events.

Affected Products

Cal.com Cal.diy version 2.1.1 (lower bound)
Cal.com Cal.diy versions 2.1.1 through 6.2.0
Cal.com Cal.diy version 6.2.0 (upper bound)

Discovery Timeline

2026-08-12 - CVE-2026-57858 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-57858

Vulnerability Analysis

The BookingPageTagManager component embeds an event owner's analytics tracking ID directly into an inline <script> block rendered on public booking pages. Because the value is interpolated into a JavaScript string literal without escaping or contextual sanitization, an authenticated event owner can supply a tracking ID that terminates the string and appends arbitrary JavaScript.

Once persisted, the payload executes in the browser of every visitor to the affected public booking page. This grants the attacker access to session cookies, the ability to issue forged authenticated requests as the visitor, and the ability to exfiltrate booking data. Chaining the payload with cross-site request forgery (CSRF)-able endpoints allows the exploit to write itself onto additional events, producing wormable propagation across a tenant.

Root Cause

The root cause is missing output encoding at a JavaScript-context sink [CWE-79]. User-controlled data intended as an identifier is concatenated into an inline script body, where standard HTML-context escaping is insufficient. Only strict allowlist validation of the tracking ID format, or serialization with JSON.stringify inside the script context, would neutralize the injection.

Attack Vector

An authenticated user with event-owner privileges edits an event and submits a malicious analytics tracking ID containing a JavaScript breakout sequence. The server stores the value and later renders it inside an inline <script> element on the public booking route. Any unauthenticated visitor loading that route triggers the payload. Because the trigger surface is a public booking page, user interaction is limited to navigating to the URL, which the attacker can distribute through invitations, calendar links, or search indexing.

No verified public exploit code is available. See the VulnCheck advisory on Cal.com XSS and the Ashton research blog for additional technical detail.

Detection Methods for CVE-2026-57858

Indicators of Compromise

Analytics tracking ID fields in event configuration containing quote characters, angle brackets, or the substrings </script, javascript:, or onerror=.
Outbound requests from booking page visitors to domains not associated with Google Analytics, Meta Pixel, or other legitimate analytics providers.
Unexpected modifications to multiple events sharing the same injected tracking ID value, indicating wormable propagation.
Booking page HTML responses containing inline <script> blocks with unbalanced string literals or unexpected function calls.

Detection Strategies

Inspect the Cal.diy database column that stores analytics tracking IDs and validate each value against a strict format such as ^(G-|UA-|GTM-|AW-)[A-Z0-9-]+$.
Deploy a Content Security Policy (CSP) report-only header on booking pages to surface inline script violations that indicate injected payloads.
Add web application firewall (WAF) rules that inspect POST bodies to event-update endpoints for JavaScript metacharacters in the tracking ID parameter.

Monitoring Recommendations

Alert on any HTTP response from Cal.diy booking routes containing script tags outside a known allowlist of analytics vendors.
Log all event configuration changes with the acting user identity and diff the analytics tracking ID field between revisions.
Monitor authenticated session activity for anomalous booking-page traffic patterns that suggest cookie theft or session replay.

How to Mitigate CVE-2026-57858

Immediate Actions Required

Upgrade Cal.com Cal.diy to a release later than 6.2.0 that includes the sanitization fix once available from the vendor.
Audit all existing events and clear analytics tracking IDs that do not match the expected vendor format.
Restrict event-owner privileges to trusted users and require multi-factor authentication for accounts with event-editing rights.
Rotate session secrets and force reauthentication if injected payloads are found in historical event records.

Patch Information

Refer to the Cal.com GitHub repository for release notes and the fix commit addressing the BookingPageTagManager sanitization gap. Coordinate the upgrade window with the guidance in the VulnCheck advisory.

Workarounds

Apply a strict Content Security Policy that forbids inline scripts on booking pages and permits only hashed or nonce-bound analytics snippets.
Enforce server-side allowlist validation on the analytics tracking ID input before persistence, rejecting any value containing quote or angle-bracket characters.
Temporarily disable the analytics tracking ID feature at the application configuration level until patched builds are deployed.

bash

# Example CSP header to block inline script injection on booking pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-RANDOMNONCE' https://www.googletagmanager.com https://www.google-analytics.com; object-src 'none'; base-uri 'self'";