The vulnerability in Cal.com cal.diy before version 5.9.9 arises from its inclusion of a vulnerable Next.js version. Specifically, the React Server Components (RSC) request handler deserializes attacker-controlled input, enabling unauthenticated remote code execution. An attacker can exploit this by sending a specially crafted RSC request, triggering arbitrary code execution during server-side processing. This vulnerability is a direct consequence of the upstream Next.js vulnerability CVE-2025-55182. The issue is resolved in cal.diy 5.9.9 by updating the Next.js dependency to a patched version.

Successful exploitation allows a remote attacker to execute arbitrary code on the server hosting cal.diy without any authentication or user interaction. This can lead to full system compromise, data theft, service disruption, or further attacks originating from the compromised server. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in cal.diy version 5.9.9, which updates the vulnerable Next.js dependency to a patched version. Users should upgrade to version 5.9.9 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the update. Patch status is confirmed by the vendor's versioning information. No alternative mitigations are indicated in the advisory.