Cal.com CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Cal.com CVE published 2026-08-12

CVE-2026-57858

CVE-2026-57858 is a stored cross-site scripting vulnerability in the BookingPageTagManager component of Cal.com Cal.diy versions 2.1.1 through 6.2.0. Authenticated event owners can inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization, enabling session cookie theft, forged authenticated requests, and wormable propagation.