CVE-2026-57858 is a stored cross-site scripting vulnerability affecting Cal.com Self-Hosted (Cal.diy) versions 2.1.1 through 6.2.0. The flaw exists in the BookingPageTagManager component, where an authenticated event owner can inject arbitrary JavaScript by supplying a malicious analytics tracking ID without proper input neutralization. The injected script executes in the context of every visitor's browser on the affected public booking page. This enables attackers to steal session cookies, forge authenticated requests, and propagate the attack by leveraging CSRF vulnerabilities on other endpoints to persist the payload across multiple events.

Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of users visiting the affected booking pages. This can lead to theft of session cookies, unauthorized actions performed on behalf of users, and wormable propagation of the malicious payload to other events via CSRF chaining. The vulnerability requires authenticated event owner privileges to inject the payload but affects all visitors to the public booking pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict event owner privileges to trusted users only and consider disabling or restricting the use of custom analytics tracking IDs in the BookingPageTagManager component. Monitor vendor communications for updates on patches or official mitigations.