Calcom vulnerabilities
We track 6 vulnerabilities in Calcom products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest Calcom vulnerabilities
- 10.0 Critical severity
cal.diy: Improper Control of Generation of Code
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a craft
- 8.9 High severity
cal.diy: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing
- 9.9 Critical severity
cal.diy: Improper Neutralization of Special Elements used in a Command
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down
- 8.9 High severity
cal.diy: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML wi
- 9.8 Critical severity
cal.com: Client-Side Enforcement of Server-Side Security
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.upd
- 9.8 Critical severity
cal.com: Incorrect Implementation of Authentication Algorithm
Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists du