CVE-2024-58355 is a stored cross-site scripting vulnerability in Cal.com cal.diy affecting versions before 4.7.16. The vulnerability arises from unsafe use of React's dangerouslySetInnerHTML to render booking-question labels without input sanitization or escaping. Attackers who can create event types with malicious booking-question labels can inject arbitrary HTML/JavaScript that executes in the context of users viewing the booking page. This can lead to script execution with high impact on confidentiality, integrity, and availability. The issue is resolved in version 4.7.16.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser when viewing a crafted booking URL. This can lead to theft of sensitive information, session hijacking, or other malicious actions depending on the victim's privileges and environment. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Upgrade Cal.com cal.diy to version 4.7.16 or later, where this vulnerability is fixed. No other mitigations are specified or recommended since the fix addresses the root cause by properly handling user input in booking-question labels.