CyberRota Analysis
AI-GeneratedCal.com versions prior to 5.9.9 are critically vulnerable to unauthenticated remote code execution due to insecure deserialization in React Server Components, allowing attackers to execute arbitrary code on the server. This vulnerability stems from an upstream issue in Next.js and can be exploited without authentication or user interaction. Organizations using affected versions should prioritize immediate updates to version 5.9.9 or later to mitigate this severe risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.