CVE-2024-58353 is a critical XSS vulnerability in Cal.com cal.diy (<=4.7.15) where booking question labels are rendered unsafely via React's dangerouslySetInnerHTML without sanitization or CSP. An attacker able to create an event type with a crafted booking question label can inject arbitrary script code that executes in the context of users visiting the booking view URL. This primarily affects self-hosted instances with open registration. The vulnerability is resolved in version 4.7.16.

Successful exploitation allows an attacker to execute arbitrary HTML or JavaScript in the browsers of users visiting the affected booking view pages. This can lead to session hijacking, credential theft, or other malicious actions within the security context of the vulnerable application. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation with low attack complexity and no privileges required beyond user registration.

Upgrade affected Cal.com cal.diy instances to version 4.7.16 or later, where this vulnerability is fixed. Self-hosted deployments with open registration should prioritize this update. No other mitigations such as CSP or input sanitization are indicated as official fixes. Patch status is confirmed fixed in 4.7.16.