CVE-2025-71389

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71389", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-16T12:14:41.769Z", "datePublished": "2026-07-23T21:16:44.870Z", "dateUpdated": "2026-07-28T01:48:14.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:14.200Z"}, "datePublic": "2025-12-07T00:00:00.000Z", "title": "Cal.com before 5.9.9 Remote Code Execution via RSC", "descriptions": [{"lang": "en", "value": "Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "calcom", "product": "cal.diy", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "5.9.9"}, {"version": "5.9.9", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.9.9"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL"}}], "references": [{"url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4", "name": "GitHub Security Advisory (GHSA-qjx2-5xqp-cpf4)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/calcom/cal.diy/pull/25592", "name": "Patch (PR #25592)", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp", "name": "Upstream Next.js advisory (CVE-2025-55182)", "tags": ["related"]}, {"name": "VulnCheck Advisory: Cal.com before 5.9.9 Remote Code Execution via RSC", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T22:07:00.836723Z", "id": "CVE-2025-71389", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T22:07:11.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T22:07:00.836723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T22:07:07.114Z"}}], "cna": {"title": "Cal.com before 5.9.9 Remote Code Execution via RSC", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "calcom", "product": "cal.diy", "versions": [{"status": "affected", "version": "0", "lessThan": "5.9.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.9.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-12-07T00:00:00.000Z", "references": [{"url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4", "name": "GitHub Security Advisory (GHSA-qjx2-5xqp-cpf4)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/calcom/cal.diy/pull/25592", "name": "Patch (PR #25592)", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp", "name": "Upstream Next.js advisory (CVE-2025-55182)", "tags": ["related"]}, {"url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc", "name": "VulnCheck Advisory: Cal.com before 5.9.9 Remote Code Execution via RSC", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.9.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:14.200Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71389", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:48:14.200Z", "dateReserved": "2026-07-16T12:14:41.769Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-23T21:16:44.870Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "cal.diy", "vendor": "calcom", "versions": [{"lessThan": "5.9.9", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.9.9", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency."}, {"lang": "es", "value": "Cal.com (calcom/cal.diy) anterior a la versi\u00f3n 5.9.9 es vulnerable a ejecuci\u00f3n remota de c\u00f3digo no autenticada porque incluye una versi\u00f3n de Next.js cuyo manejo de solicitudes de React Server Components (RSC) deserializa la entrada controlada por el atacante. Un atacante remoto puede enviar una solicitud RSC manipulada al servidor y provocar que se ejecute c\u00f3digo arbitrario durante el procesamiento del lado del servidor, sin autenticaci\u00f3n ni interacci\u00f3n del usuario. La falla se deriva de la vulnerabilidad de Next.js ascendente CVE-2025-55182 y se resuelve en la versi\u00f3n 5.9.9 al actualizar la dependencia afectada."}], "id": "CVE-2025-71389", "lastModified": "2026-09-29T14:10:00.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71389", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-24T22:07:00.836723Z", "version": "2.0.3"}}]}, "published": "2026-07-23T22:16:51.750", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/calcom/cal.diy/pull/25592"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.9.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.9.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cal.diy", "source": "cna", "vendor": "calcom"}, "product": "cal.diy", "vendor": "calcom"}], "created": "2026-07-24T00:00:05.554480+00:00", "updated": "2026-08-03T21:00:12.548220+00:00", "vendors": ["calcom", "calcom$PRODUCT$cal.diy"]}