CVE-2024-58353 is a critical cross-site scripting vulnerability in Cal.com cal.diy (<=4.7.15). The vulnerability occurs because booking question labels are rendered via React's dangerouslySetInnerHTML without input sanitization or CSP enforcement. An attacker able to create an event type with a crafted booking question label can inject malicious HTML/JavaScript that executes in the context of the booking view page (/booking/<id>). This affects self-hosted instances with open registration, increasing risk. The vulnerability is resolved in version 4.7.16.

Successful exploitation allows an attacker to execute arbitrary script code in the context of the booking view page, potentially leading to session hijacking, defacement, or other malicious actions against users viewing the booking page. The vulnerability requires the attacker to create an event type with a malicious label, so it primarily affects instances permitting such user input. The CVSS 4.0 score is 9.3 (critical), reflecting high impact and ease of exploitation with low attack complexity and no privileges required beyond low-level user access.

Upgrade Cal.com cal.diy to version 4.7.16 or later, where this XSS vulnerability is fixed. Until upgrading, restrict event type creation permissions to trusted users only and consider implementing additional input validation or CSP as a temporary mitigation. Since this is a self-hosted product, patching the software is the primary remediation.