CVE-2025-71389

Received Received - Intake

Unauthenticated Remote Code Execution in Cal.com

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2025-71389

Affected Vendors & Products

Vendor	Product	Version / Range
calcom	cal	to 5.9.9 (exc)
vercel	next.js	to 5.9.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Cal.com before version 5.9.9 is vulnerable to unauthenticated remote code execution due to a flaw in Next.js React Server Components (RSC) request handling. An attacker can send a crafted RSC request to execute arbitrary code on the server without authentication or user interaction.

Detection Guidance

Detecting this vulnerability requires checking if your Cal.com instance is running a vulnerable version (before 5.9.9). Inspect the package version in your deployment or logs. No specific commands are provided for detection beyond version checks.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the server hosting Cal.com. This could lead to complete system compromise, data theft, unauthorized access, or disruption of services. Systems running vulnerable versions are at high risk.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data, leading to potential breaches. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from such security failures.

Mitigation Strategies

Upgrade Cal.com to version 5.9.9 or later to address the vulnerability. This resolves the issue by updating the affected Next.js dependency. Ensure no unauthenticated RSC requests are processed during the upgrade.

Hi! I’m here to help you understand CVE-2025-71389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70