CVE-2025-71389

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/advisories/GHSA-9qr9-h5gf-34mp
https://github.com/calcom/cal.diy/pull/25592
https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4
https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc

Configurations

No configuration.

History

29 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Cal.com (calcom/cal.diy) anterior a la versión 5.9.9 es vulnerable a ejecución remota de código no autenticada porque incluye una versión de Next.js cuyo manejo de solicitudes de React Server Components (RSC) deserializa la entrada controlada por el atacante. Un atacante remoto puede enviar una solicitud RSC manipulada al servidor y provocar que se ejecute código arbitrario durante el procesamiento del lado del servidor, sin autenticación ni interacción del usuario. La falla se deriva de la vulnerabilidad de Next.js ascendente CVE-2025-55182 y se resuelve en la versión 5.9.9 al actualizar la dependencia afectada.

Information

Published : 2026-07-23 22:16

Updated : 2026-09-29 14:10

NVD link : CVE-2025-71389

Mitre link : CVE-2025-71389

CVE.ORG link : CVE-2025-71389

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-71389", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71389", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T22:07:00.836723Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "calcom", "product": "cal.diy", "versions": [{"status": "affected", "version": "0", "lessThan": "5.9.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.9.9", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-23T22:16:51.750", "references": [{"url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/calcom/cal.diy/pull/25592", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency."}, {"lang": "es", "value": "Cal.com (calcom/cal.diy) anterior a la versi\u00f3n 5.9.9 es vulnerable a ejecuci\u00f3n remota de c\u00f3digo no autenticada porque incluye una versi\u00f3n de Next.js cuyo manejo de solicitudes de React Server Components (RSC) deserializa la entrada controlada por el atacante. Un atacante remoto puede enviar una solicitud RSC manipulada al servidor y provocar que se ejecute c\u00f3digo arbitrario durante el procesamiento del lado del servidor, sin autenticaci\u00f3n ni interacci\u00f3n del usuario. La falla se deriva de la vulnerabilidad de Next.js ascendente CVE-2025-55182 y se resuelve en la versi\u00f3n 5.9.9 al actualizar la dependencia afectada."}], "lastModified": "2026-09-29T14:10:00.117", "sourceIdentifier": "disclosure@vulncheck.com"}