External risk intelligence

Cal.com Unauthenticated Remote Code Execution via Next.js RSC Deserialization

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-71389

Cal.com is a scheduling platform designed to be publicly accessible as a web application. Because it functions as an internet-facing service that must receive requests from external users to operate, the vulnerable component is exposed by design.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Cal.com's scheduling platform that allows unauthenticated remote code execution. The issue stems from an underlying dependency that mishandles certain server requests, enabling an attacker to run arbitrary code on the server without needing to log in. This could have significant implications for the integrity and availability of the platform's services.

Unauthenticated attackers can execute code.
This affects a widely used scheduling service.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the server. This request targets how the application handles React Server Components (RSC), tricking it into executing arbitrary code during server-side processing.

No authentication or user interaction needed.
Crafted RSC request triggers deserialization.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the server when processing specially crafted requests. This could impact the availability and integrity of the affected service.

Server-side code execution.
Crafted RSC requests.
Service integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Cal.com's unauthenticated remote code execution vulnerability requires immediate attention from teams managing the Cal.com application and its underlying infrastructure. The first step is to confirm the deployment scope, assess business criticality, identify the precise ownership of affected instances, and then prioritize remediation based on risk exposure.

Application owners and platform teams.
Verify instance reachability and criticality.
Plan targeted updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com?

Cal.com is a scheduling infrastructure platform that helps individuals and businesses organize meetings and events. It operates as a web application, often hosted to be publicly reachable so that external users can easily book time, manage calendars, and interact with scheduling workflows directly through their browsers.

How does CVE-2025-71389 create a security weakness?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. Essentially, the software contains a flaw in how it handles specific data requests for React Server Components. Because the application processes this input insecurely, it can be tricked into executing unintended commands on the underlying server.

What triggers this remote code execution?

An attacker triggers the vulnerability by sending a specially crafted React Server Component request to the server. The flaw is specifically tied to the deserialization of this input during server-side processing. Normal, legitimate user interactions that do not involve these malformed component requests do not activate the exploit path.

Is my Cal.com instance at risk?

Halo Surface Signal indicates that Cal.com is designed to be a public-facing service, meaning the vulnerable component is often exposed to the internet by design. If you run a version before 5.9.9, your instance is likely reachable by unauthorized remote actors who can send these malicious requests without needing to authenticate.

Do I need to update my software immediately?

Yes, if you manage a Cal.com installation, you should prioritize updating to version 5.9.9 or later. The first practical step is to verify your current version and identify all deployed instances. Since this allows unauthorized command execution, teams should move quickly to patch the underlying dependency issue addressed in the latest release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.