HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-57858 — Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripti...

·Source: NIST NVD

Updated:

Executive Summary

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to

Analysis

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events. CVSS Score: 8.9. Published: 2026-08-12T13:17:22.943.

Indicators of Compromise (2)

CVE (1)
CVE-2026-57858
NVDMITRE CVE
Domain (1)
Cal.com
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Aug 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Stablecoins offer little cost or speed advantage for remittances - Banca d'Italia

Stablecoins show no systematic cost advantage over traditional remittance channels for cross-border payments, researchers at Banca d'Italia have found.

Finextra
MEDIUMVulnerability

Mobile wallets gain traction in the UK

Cards continue to dominate UK payments but mobile wallets are increasingly popular, with nearly two thirds of the population registered with at least one provider, according to the latest industry data.

Finextra
MEDIUMVulnerability

CISA Weighs Outsourcing Its Cyber Software Buying

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cisa-weighs-outsourcing-its-cyber-software-buying-image_small-9-a-32595.jpg" align=right hspace=4><b>CISA Issues Sources Sought Notice Floating $600M a Year, $6B Over Contract Life</b><br>The U.S. Cybersecurity and Infrastructure Security Agency is surveying industry on whether a contractor could take over cybersecurity software b

Bank Info Security