The vulnerability in Cal.com cal.diy prior to version 5.9.9 arises from its inclusion of a vulnerable Next.js version. The React Server Components (RSC) request handler in Next.js improperly deserializes attacker-controlled input, allowing remote attackers to execute arbitrary code on the server without authentication or user interaction. This is a direct consequence of the upstream Next.js vulnerability CVE-2025-55182. Cal.com addressed this issue by updating the Next.js dependency in version 5.9.9, mitigating the risk of unauthenticated remote code execution.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server running cal.diy, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at the time of this report.

Upgrade cal.diy to version 5.9.9 or later, which includes an updated Next.js dependency that resolves the vulnerability. Since this is a self-hosted product, users must apply the update themselves. Patch status is confirmed by the vendor's versioning; no other official fixes or temporary mitigations are documented. Monitor vendor advisories for further updates.