CVE-2025-54313
HIGH KEVeslint-config-prettier <10.1.7 - Code Injection
Title source: llmDescription
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Exploits (2)
References (10)
Scores
CVSS v3
7.5
EPSS
0.1162
EPSS Percentile
93.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Details
CISA KEV
2026-01-22
VulnCheck KEV
2025-07-19
ENISA EUVD
EUVD-2025-21972
CWE
CWE-506
Status
published
Products (18)
alexghr/got-fetch
5.1.1
alexghr/got-fetch
5.1.2
homarr/homarr
1.29.0 - 1.30.0
npm/eslint-config-prettier
8.10.1 - 8.10.2npm
npm/eslint-plugin-prettier
4.2.2 - 4.2.4npm
npm/got-fetch
5.1.11 - 6.0.0npm
npm/napi-postinstall
0.3.1 - 0.3.2npm
npm/synckit
0.11.9 - 0.11.10npm
pkgr/core
0.2.8 - 0.2.9npm
prettier/eslint-config-prettier
8.10.1
... and 8 more
Published
Jul 19, 2025
KEV Added
Jan 22, 2026
Tracked Since
Feb 18, 2026