A cross-site scripting vulnerability in cal.diy allows authenticated attackers to execute arbitrary scripts, creating a substantial risk to user data and session integrity.

This is a CWE-80 vulnerability involving improper neutralization of script-related HTML tags. It requires an authenticated user with low privileges to trigger the vulnerability through specially crafted booking questions.

Successful exploitation permits attackers to compromise user sessions and perform unauthorized actions, potentially leading to widespread data exposure. With a CVSS score of 8.9, this vulnerability poses a severe threat to the confidentiality and integrity of the affected application.

Immediate Action: Apply the latest security updates provided by the vendor to remediate the underlying sanitization flaw.

Proactive Monitoring: Review user-generated content and booking logs for signs of script injection or unusual character sequences.

Compensating Controls: Utilize a Web Application Firewall (WAF) to prevent the delivery of malicious scripts to the application.

Public Exploit Available: No

The high CVSS score necessitates immediate attention to prevent potential exploitation. Administrators should apply the vendor-recommended patches as soon as they are available to ensure the security of their deployment.