CVE-2025-54313

Published Jul 19, 2025

Last updated a month ago

Exploit knownCVSS high 7.5
npm
eslint-config-prettier
Supply chain

Overview

Description
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Source
cve@mitre.org
NVD status
Analyzed
Products
eslint-config-prettier, eslint-plugin-prettier, synckit, pkgr\/core, got-fetch, napi-postinstall, homarr

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
4.7
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Severity
HIGH

Known exploits

Data from CISA

Vulnerability name
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
Exploit added on
Jan 22, 2026
Exploit action due
Feb 12, 2026
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org
CWE-506

Social media

Hype score
Not currently trending
  1. CVE-2025-68645 CVE-2025-34026 CVE-2025-31125 CVE-2025-54313 CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities Jan 23, 2026 https://t.co/8V92lYMDDx

    @tdatwja

    24 Jan 2026

    317 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. CISA KEV update: 4 vulnerabilities are confirmed exploited in the wild: Versa Concerto (CVE-2025-34026), Zimbra Classic UI (CVE-2025-68645), Vite dev server exposure (CVE-2025-31125), and a eslint-config-prettier supply chain trojan (CVE-2025-54313). What to patch and check:

    @Anavem_

    23 Jan 2026

    786 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 CISA Adds 4 Actively Exploited Flaws to KEV: Prettier Supply-Chain, Vite, Versa SD-WAN, and Zimbra CISA added four vulnerabilities to the KEV catalog after confirmed in-the-wild exploitation, including malicious code in eslint-config-prettier (CVE-2025-54313) that drops

    @ThreatSynop

    23 Jan 2026

    65 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🦺 CVE-2025-54313 Had to check a lot of projects regarding #CVE202554313, #isSupplyChainAttack. This script runs some checks and reduces the amount of time. It's not perfect yet. Script: https://t.co/zirgN3xpdW Details: https://t.co/iDbvTLav9Q

    @marklubkowitz

    26 Jul 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. CVE-2025-54313 Supply Chain Compromise in eslint-config-prettier Packages via Malicious Install Script https://t.co/VpQsNvZGrE

    @VulmonFeeds

    19 Jul 2025

    109 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-54313 eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install… https://t.co/OkJtFiexVs

    @CVEnew

    19 Jul 2025

    719 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations