"A critical CI/CD flaw in the calcom (later cal.diy) repository lets an attacker take over the repository by opening a malicious pull request that runs arbitrary code with a write-scoped `GITHUB_TOKEN`."

Here's the article.

CVE-2024-58354: Repository Takeover in cal.com's GitHub Actions Workflows

A critical CI/CD flaw in the calcom (later cal.diy) repository lets an attacker take over the repository by opening a malicious pull request that runs arbitrary code with a write-scoped GITHUB_TOKEN.

What Is It

CVE-2024-58354 is a repository takeover vulnerability (CWE-77, command injection) in the GitHub Actions workflows of cal.com's calcom repository, later renamed cal.diy. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. That workflow then performs a "dangerous" checkout of attacker-submitted pull request code via the dangerous-git-checkout action and executes it through yarn install and package.json scripts. An attacker who opens a pull request can therefore run arbitrary commands with the repository's write-scoped GITHUB_TOKEN.

Why It Matters

With a write-scoped token, an attacker can push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches; effectively compromising the repository. NVD rates the flaw CVSS 3.1 base score 9.9 (CRITICAL), with a scope-changed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H). The secondary CVSS 4.0 score is 8.5 (HIGH). The attack is network-based, low-complexity, requires only low privileges, and needs no user interaction.

What's Vulnerable

The affected product is calcom's cal.diy (formerly the calcom repository). The main branch is affected.

Patch Status

No patched version is available. The vulnerability was disclosed by VulnCheck, and a GitHub security advisory (GHSA-p3f6-52gv-cj7m) and a related commit are published in the references below. This CVE does not appear in the CISA KEV catalog, and there is no confirmed active exploitation in the supplied source material.

Sources

NVD, CVE-2024-58354: https://nvd.nist.gov/vuln/detail/CVE-2024-58354
VulnCheck Advisory; cal.com repository takeover via pull_request_target workflow: https://www.vulncheck.com/advisories/cal-com-repository-takeover-via-pull-request-target-workflow
GitHub Security Advisory GHSA-p3f6-52gv-cj7m: https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m
GitHub commit: https://github.com/calcom/cal.diy/commit/9aa60fae41a6b6b101c86bf430754b439f440871