Description
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| calcom | cal.diy | < 5.9.9 | 5.9.9 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
0xdak/CVE-2025-71389_exploit ★ 0 · Jul 28, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Security Advisory (GHSA-qjx2-5xqp-cpf4) vendor-advisory
- Patch (PR #25592) issue-tracking patch
- Upstream Next.js advisory (CVE-2025-55182) related
- VulnCheck Advisory: Cal.com before 5.9.9 Remote Code Execution via RSC third-party-advisory