Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-13 | 2 | Disclosure1Patch1 |
| 2026-08-14 | 1 | Disclosure1 |
If you run self-hosted https://Cal.com, stop what you're doing and check your version. CVE-2026-57858 is a stored XSS vuln in the booking page analytics config. Here's what to audit Thursday:
Post summary
A stored XSS vulnerability (CVE‑2026‑57858) in self‑hosted Cal.com’s booking analytics config is disclosed, urging users to audit their installations.
I’m disclosing an 8.9 CVSS Stored XSS (CVE-2026-57858) in @calcom self-hosted version. The team and DIY maintainers refused to accept the issue over a 7 month period since it doesn’t affect their SaaS offering. The self-hosted users deserve disclosure. https://www.cve.org/CVERecord?id=CVE-2026-57858
Post summary
The author discloses a high‑severity stored XSS in Cal.com self‑hosted versions, noting that maintainers have declined to address the issue; no PoC, exploit, or active exploitation evidence is provided.
Self-hosted tools shift the patch timeline to you. Check your https://Cal.com version Thursday, not next sprint. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-57858
Post summary
The message urges Cal.com self‑hosted users to patch before Thursday for CVE-2026-57858, without disclosing technical exploit details.