Skip to content

Cal.com affected by CVE-2025-55182 and CVE-2025-66478

Critical
keithwillcode published GHSA-qjx2-5xqp-cpf4 Dec 7, 2025

Package

No package listed

Affected versions

<= 5.9.8

Patched versions

>= 5.9.9

Description

All self-hosters should upgrade to v5.9.9 or above of Cal.com as soon as possible using the tag, a cherry-pick of the patch or the Docker image.

Description

A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in unpatched environments.

Workarounds

Manually patching your self-hosted instance of Cal.com to use an approved version of Next.js/React as suggested by Vercel here.

References

CVE-2025-55182
CVE-2025-66478

Severity

Critical

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE ID

No known CVE

Weaknesses

No CWEs