Cal.com's cal.diy before version 5.9.9 contains a critical (CVSS 10.0) unauthenticated remote code execution flaw stemming from a bundled, vulnerable version of Next.js.
What Is It
CVE-2025-71389 is an unauthenticated remote code execution vulnerability in Cal.com (calcom/cal.diy) prior to version 5.9.9. The product bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing; without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is classified as CWE-94 (Code Injection).
Why It Matters
This vulnerability carries a maximum CVSS 3.1 base score of 10.0 (CRITICAL), with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. It is network-exploitable with low attack complexity, requires no privileges and no user interaction, and results in a scope change with high confidentiality, integrity, and availability impact. Because exploitation requires only a crafted request to a reachable server, an attacker who can reach the application can achieve full server-side code execution.
What's Vulnerable
- Vendor/Product: calcom / cal.diy
- Affected versions: all versions before 5.9.9 (semver
< 5.9.9) - Fixed version: 5.9.9 and later (unaffected)
Patch Status
The issue is resolved in cal.diy version 5.9.9, which updates the affected Next.js dependency. Organizations running cal.diy should upgrade to 5.9.9 or later to remediate the flaw. Note: this CVE record is not present in the CISA KEV catalog supplied, and the supplied data does not confirm active exploitation.