## https://sploitus.com/exploit?id=7C5D0053-65AE-5702-9D20-3DADA64BD887
# CVE-2025-71389 — Cal.com Unauthenticated RCE via Next.js RSC Deserialization
| | |
|---|---|
| **CVSS v3** | 10.0 (Critical) |
| **CWE** | CWE-94 Code Injection (insecure deserialization) |
| **Affected** | Cal.com (`calcom/cal.diy`) For authorized security testing, CTF, and research only.
## Summary
Cal.com bundles a version of Next.js whose **React Server Components (RSC)** request handling **deserializes attacker-controlled input**. A remote, unauthenticated attacker can send a crafted RSC request (a "server action" payload) that causes arbitrary code to run during server-side processing — no auth, no user interaction. It derives from upstream Next.js **CVE-2025-55182** and is fixed in Cal.com 5.9.9 by updating the dependency.
## Root cause
The server treats the serialized RSC action payload as trusted and materializes/executes it without verifying it corresponds to a registered server action. The fix pins a Next.js version that validates the action reference before dispatch.
## Detection (`poc.py`)
Non-destructive: sends an RSC-style request (`Next-Action` header) whose serialized action encodes a **benign arithmetic marker**. If the server evaluates it (marker appears in the response), untrusted action payloads are being deserialized/executed → **VULNERABLE**. No OS/process payloads are sent.
```bash
python poc.py --target http://TARGET:5003
```
## Lab
```bash
docker compose up --build # vulnerable on :5003, patched on :5004
./run-tests.sh
```
## Remediation
- Upgrade Cal.com to **5.9.9+** (pulls the patched Next.js).
- Only dispatch RSC server actions from a validated registry; never execute action payloads by reference from the request.
- Apply `prevention/` to block unregistered `Next-Action` payloads at the edge.