Read the docs
TI-2025-43505 Aliases CVE-2025-71389GHSA-8449-9vw6-7mp5

Cal.com before 5.9.9 Remote Code Execution via RSC

Priority MEDIUM 52CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01354 71st percentileScored 2026-11-07
Fix Fixed cal.diy (calcom): 5.9.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
calcomcal.diybefore 5.9.95.9.9Patch availableCNA
  • cal.diy Vendorcalcom Affected before 5.9.9 Fixed in 5.9.9 Patch available CNA

Remediation

  • Fix · CNA cal.diy (calcom) Fixed in 5.9.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-71389
  2. 2026-10-03 Alias added: GHSA-8449-9vw6-7mp5

References

Patch 1

Advisory 1

Other 1

  • TI-2024-38439 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
  • TI-2024-38437 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
  • TI-2024-38438 cal.com Repository Takeover via pull_request_target Workflow CVSS 4.0HIGH 8.5
  • TI-2026-08199 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2023-19352 Cal.com not expiring old sessions after enabling 2FA CVSS 3.1MEDIUM 6.5
  • TI-2026-76231 Authorization bypass in cal.com and cal.diy webhook handler CVSS 4.0MEDIUM 5.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences