CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
Attackers can execute arbitrary code with write permissions via pull_request_target workflows, compromising the repository integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58354?
CVE-2024-58354 is a high-severity code injection vulnerability in calcom cal.diy, published on 23 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git-checkout action) and subsequently executes it (through yarn install and package.json scripts). An attacker can open a pull request whose code runs arbitrary commands with the repository's write-scoped GITHUB_TOKEN, allowing them to push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches, thereby compromising the repository. The main branch is affected; no patched version is available.
Weakness: CWE-77
Which versions are affected by CVE-2024-58354?
How do I fix CVE-2024-58354?
No fix has been published for CVE-2024-58354 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-58354 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58354 exists.
Sources
Also known as GHSA-hv2p-r28v-79q5, GHSA-p3f6-52gv-cj7m.