Which versions of Cal.com cal.diy are affected by CVE-2025-71389?

Cal.com's cal.diy product contains a critical remote code execution vulnerability (CVE-2025-71389, CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on servers hosting…. A patch is available.

How to fix or mitigate CVE-2025-71389?

Within 24 hours: Conduct a complete inventory of cal.diy deployments and versions currently in use, restrict network access to affected instances to authorized networks only, and implement WAF rules to filter React Server Component protocol requests where technically feasible. Within 7 days: Deploy comprehensive logging and alerting for RSC-related traffic to detect exploitation attempts, formally escalate the vulnerability to Cal.com support to confirm patch timeline, and evaluate network segmentation to isolate cal.diy infrastructure from systems storing sensitive data. Within 30 days: Maintain elevated monitoring posture, finalize upgrade plan for patched version 5.9.9 or later once released by Cal.com, and document any temporary operational mitigations or service modifications implemented to reduce exposure.

Cal.com cal.diy CVE-2025-71389

Q: What is the CVSS score of CVE-2025-71389?

CVE-2025-71389 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2025-210506 CRITICAL

Code Injection (CWE-94)

2026-07-23 VulnCheck

GHSA-8449-9vw6-7mp5

RCE Code Injection Cal Diy Calcom

10.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated remote RSC request (AV:N/AC:L/PR:N/UI:N) yields server-side code execution with full impact; scope changed (S:C) since compromise extends beyond the vulnerable component to the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 23:03 EUVD

Source Code Evidence Fetched

Jul 23, 2026 - 22:01 vuln.today

Analysis Generated

Jul 23, 2026 - 22:01 vuln.today

CVE Published

Jul 23, 2026 - 21:16 cve.org

CRITICAL 10.0

DescriptionCVE.org

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

AnalysisAI

Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code on the server by sending a crafted React Server Components (RSC) request. The flaw stems from a bundled vulnerable Next.js version (upstream CVE-2025-55182) that unsafely deserializes attacker-controlled input in the React flight protocol. Rated CVSS 4.0 10.0 (critical) with no authentication or user interaction required; no public exploit identified at time of analysis, though the underlying Next.js class of bug is well documented via the GHSA advisory.

Technical ContextAI

The affected technology is Cal.com's cal.diy scheduling application built on Next.js using the App Router, which renders React Server Components. RSC uses the React 'flight' serialization protocol to pass component payloads between client and server; the vulnerable react-server-dom-* packages (react-server-dom-parcel/turbopack/webpack) deserialize attacker-supplied RSC request data during server-side processing. Per CPE cpe:2.3:a:calcom:cal.diy, only the cal.diy product line is identified. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): untrusted serialized input is interpreted in a way that yields code execution during deserialization, the same defect tracked upstream as CVE-2025-55182 affecting Next.js 15.x/16.x App Router deployments and React 19.0.0-19.2.0.

RemediationAI

Vendor-released patch: upgrade cal.diy to version 5.9.9 or later, which updates the bundled Next.js to patched builds (next 15.5.7 for the web app and ^15.4.8 for the API app, per PR #25592). If you maintain your own Next.js dependency, upgrade to a patched stable release along the corresponding branch - 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7 (and update React to 19.0.1/19.1.2/19.2.1 where applicable); users on 14.3 canary builds should move to a 14.x stable release or 14.3.0-canary.76. Follow the guidance in the vendor advisory (https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4) and the upstream advisory (https://github.com/advisories/GHSA-9qr9-h5gf-34mp). Where immediate patching is impossible, compensating controls include placing the app behind a WAF or reverse proxy that inspects and blocks anomalous RSC/App-Router POST requests (side effect: RSC uses legitimate serialized payloads, so rules must be tuned to avoid breaking normal navigation and server actions), and restricting network exposure of the application to trusted networks or VPN until patched (side effect: reduces availability for legitimate remote users); these are stopgaps only and do not fully close the code-injection path, so patching to 5.9.9 remains the required fix.