A critical unauthenticated remote code execution vulnerability in cal.diy allows attackers to execute arbitrary code on the host server.

This is a code injection vulnerability (CWE-94) where the application improperly deserializes attacker-controlled input within React Server Components requests. An unauthenticated remote attacker can leverage this flaw to execute arbitrary code on the server.

With a CVSS score of 10.0, this is a maximum-severity vulnerability. Successful exploitation permits an attacker to take full control of the application server, potentially resulting in the compromise of all sensitive calendar data, user credentials, and internal network access.

Immediate Action: Update cal.diy to version 5.9.9 or later to patch the underlying dependency issue.

Proactive Monitoring: Monitor server logs for unusual incoming requests, particularly those involving React Server Components or attempts to execute system-level commands.

Compensating Controls: If an update cannot be applied immediately, restrict network access to the application server to known trusted IP addresses and employ a WAF to filter malicious request payloads.

Public Exploit Available: Unknown

Given the critical nature of this remote code execution vulnerability, immediate patching to version 5.9.9 is mandatory. Organizations must ensure that the update is applied across all instances of the application to prevent potential total system compromise.