SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2025-71389

CRITICAL · CVSS 10 EPSS 0.93% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-23 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

Cal.com versions prior to 5.9.9 are critically vulnerable to unauthenticated remote code execution due to insecure deserialization in React Server Components, allowing attackers to execute arbitrary code on the server. This vulnerability stems from an upstream issue in Next.js and can be exploited without authentication or user interaction. Organizations using affected versions should prioritize immediate updates to version 5.9.9 or later to mitigate this severe risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2025-71389
Severity
CRITICAL
CVSS
10
EPSS
0.93%

Original NVD Description

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.