Unauthenticated RCE in Cal.com cal.diy via Next.js React Server Components deserialization

This repository is a small standalone Python exploit for unauthenticated RCE against vulnerable Cal.com deployments. It contains two files: a README describing the vulnerability, affected versions, usage, and remediation; and a single executable script, exploit.py, which is the main entry point. The exploit targets Cal.com <= 5.9.8 by abusing vulnerable React Server Components / Next.js Flight deserialization behavior described as react2shell. The Python script sends a crafted multipart POST request to the supplied base URL with a Next-Action header and a malicious serialized object. The payload uses prototype-pollution and constructor gadgets (notably __proto__:then and constructor:constructor) to cause server-side evaluation of attacker-controlled JavaScript. That JavaScript imports Node's child_process module and invokes execSync. Capabilities are straightforward but effective: in command mode (-c/--cmd), it executes an arbitrary shell command on the target and extracts the output from the returned response body by regex-matching the digest field. In reverse shell mode (--shell HOST:PORT), it launches a detached bash reverse shell using /dev/tcp to connect back to the attacker. The reverse shell is hardcoded to bash semantics and assumes outbound connectivity from the target. Repository structure is minimal and purpose-built: no framework, no auxiliary modules, and no detection-only logic. The exploit is operational rather than just demonstrative because it includes working payload delivery and post-exploitation options, but payload customization is manual and limited to command strings or callback host:port arguments.