CVE-2024-58355 is a stored cross-site scripting vulnerability in Cal.com cal.diy affecting versions before 4.7.16. The issue arises from unsafe use of React's dangerouslySetInnerHTML to render booking-question field labels without proper input sanitization or escaping. This allows attackers with permission to create event types to inject malicious HTML or JavaScript code that executes in the context of users who open the crafted booking URLs. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. The flaw is resolved in version 4.7.16.

Successful exploitation allows an attacker to execute arbitrary HTML or JavaScript in the context of users visiting the crafted booking URL, potentially leading to session hijacking, credential theft, or other malicious actions within the affected application. The vulnerability requires the attacker to have permission to create event types but does not require user interaction beyond visiting the malicious URL.

Upgrade Cal.com cal.diy to version 4.7.16 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor stating the issue is fixed in v4.7.16.