A cross-site scripting vulnerability in cal.diy allows authenticated attackers to execute arbitrary scripts, posing a significant risk to user session security.

The software fails to properly neutralize script-related HTML tags, leading to a CWE-80 basic XSS vulnerability. The attack vector requires the attacker to be authenticated with low privileges and requires user interaction to execute the malicious payload.

Exploitation of this XSS vulnerability can lead to session hijacking, unauthorized actions performed on behalf of other users, or the theft of sensitive information. The high CVSS score of 8.9 reflects the potential for significant impact on both data confidentiality and integrity within the application environment.

Immediate Action: Update the cal.diy software to the version containing the fix, as specified in the official vendor security advisory.

Proactive Monitoring: Monitor application logs for suspicious script injection attempts or anomalous booking activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious script payloads from web requests.

Public Exploit Available: No

Security teams must treat this vulnerability with high urgency due to its potential for full session compromise. Applying the vendor-provided update is the only effective way to neutralize this flaw and ensure the continued security of the platform.