Unauthenticated remote code execution in Cal.com (cal.diy) via Next.js RSC (CVE-2025-71389)

Cal.com (cal.diy) bundles a vulnerable version of Next.js whose React Server Components request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to trigger arbitrary code execution on the server without authentication or user interaction. The flaw derives from upstream Next.js vulnerabilities CVE-2025-55182 and CVE-2025-66478. Affected versions: - <= 5.9.8 We recommend updating to: >= 5.9.9. CVSS 10.0 · our assessment: act_now Reference: https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4 Details: https://vuln.today/cve/CVE-2025-71389