Cal.com Vulnerability: Critical Remote Code Execution Risk
Cal.com before version 5.9.9 is reportedly vulnerable to unauthenticated remote code execution due to a deserialization flaw in its bundled Next.js version.
What happened
An early warning has been issued regarding a critical vulnerability in Cal.com versions prior to 5.9.9. This vulnerability, tracked as CVE-2025-71389, allows for unauthenticated remote code execution due to a deserialization flaw in the bundled Next.js version. The issue stems from the upstream Next.js vulnerability CVE-2025-55182. To assess your exposure, check if your Cal.com deployment is running a version below 5.9.9. It is recommended to upgrade to Cal.com version 5.9.9 or later to mitigate this risk. Additionally, another vulnerability, CVE-2024-58354, affects Cal.com's GitHub Actions workflows, allowing repository takeover. Primary sources should be consulted for the latest information and mitigation strategies.
How 0Day mitigates this
cal.com is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.