CVE-2025-71389 calcom CVE debrief

Who should care

Defenders responsible for Cal.com instances, particularly those with exposed or internet-facing deployments, should assess exposure and apply the patch. They should also review server logs for potential exploitation attempts and implement additional monitoring and logging to detect potential RSC request anomalies.

Why it matters

CVE-2025-71389 is a critical vulnerability in Cal.com that allows unauthenticated remote code execution. Defenders should prioritize verifying exposure and applying the patch due to the potential for remote code execution and the critical severity of the vulnerability.

• Potential for remote code execution without authentication or user interaction.
• Need for verification of affected versions and deployment contexts.
• Priority for patching or mitigating vulnerable Cal.com instances.
• Monitoring for potential exploitation attempts and anomalies.

Technical summary

CVE-2025-71389 is a critical vulnerability in Cal.com prior to version 5.9.9, allowing unauthenticated remote code execution due to a deserialization issue in Next.js React Server Components (RSC) request handling. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch due to the critical severity and potential for remote code execution.

Recommended defensive actions

• Verify if the Cal.com instance is running a version prior to 5.9.9 and update to 5.9.9 or later if necessary.
• Review server logs for potential exploitation attempts.
• Implement additional monitoring and logging to detect potential RSC request anomalies.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional verification is needed to confirm affected versions and deployment contexts. Defenders should verify if the Cal.com instance is running a version prior to 5.9.9. The vulnerability allows unauthenticated remote code execution, and its critical severity requires immediate attention.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.