CVE-2025-71389
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Cal.com (calcom/cal.diy) before version 5.9.9 is vulnerable to unauthenticated remote code execution. The application bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request and cause arbitrary code execution on the server without authentication or user interaction. The flaw originates from CVE-2025-55182 in Next.js and is fixed in version 5.9.9 by updating the dependency.
Risk Assessment
An attacker can fully compromise the Cal.com server without any authentication, potentially leading to data theft, service disruption, or using the server for further attacks.
Recommendation
Immediately update Cal.com to version 5.9.9 or later, which includes the patched version of Next.js.
Original NVD description (English source)
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.