CVE-2025-71389: calcom cal.diy Code Injection

Vulnerability summary

CVE-2025-71389 is a critical (CVSS 10.0) Code Injection vulnerability in calcom cal.diy. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71.1% of scored vulnerabilities.

Timeline

1. 23-07-2026
   PublishedVulnerability first disclosed.
2. 28-07-2026
   Last modifiedVulnerability information updated.

Description

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.