PT-2026-64182 · Cal.Com+1 · Cal.Com+1

CVE-2025-71389 · Published 2025-12-03 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 5.9.9

Description Unauthenticated remote code execution is possible because the software bundles a version of Next.js where React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server to execute arbitrary code during server-side processing without authentication or user interaction.

Recommendations Update to version 5.9.9.

Exploit

Fix

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2025-71389

GHSA-9QR9-H5GF-34MP

GHSA-QJX2-5XQP-CPF4

Affected Products

Cal.Com

Next.Js

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71389.json · Exploit
• https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71389 · Security Note
• https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71389 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55182 · Security Note
• https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r · Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp · Note
• https://github.com/calcom/cal.diy/pull/25592 · Note
• https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp · Note
• https://vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc · Note
• https://github.com/advisories/GHSA-9qr9-h5gf-34mp · Note