CVE-2025-54313

HIGH KEV

eslint-config-prettier <10.1.7 - Code Injection

Title source: llm

Description

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Exploits (2)

nomisec SCANNER
by ShinP451 · poc
https://github.com/ShinP451/scavenger_scanner
nomisec SCANNER
by nihilor · poc
https://github.com/nihilor/cve-2025-54313

Scores

CVSS v3 7.5
EPSS 0.1162
EPSS Percentile 93.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Details

CISA KEV 2026-01-22
VulnCheck KEV 2025-07-19
ENISA EUVD EUVD-2025-21972
CWE
CWE-506
Status published
Products (18)
alexghr/got-fetch 5.1.1
alexghr/got-fetch 5.1.2
homarr/homarr 1.29.0 - 1.30.0
npm/eslint-config-prettier 8.10.1 - 8.10.2npm
npm/eslint-plugin-prettier 4.2.2 - 4.2.4npm
npm/got-fetch 5.1.11 - 6.0.0npm
npm/napi-postinstall 0.3.1 - 0.3.2npm
npm/synckit 0.11.9 - 0.11.10npm
pkgr/core 0.2.8 - 0.2.9npm
prettier/eslint-config-prettier 8.10.1
... and 8 more
Published Jul 19, 2025
KEV Added Jan 22, 2026
Tracked Since Feb 18, 2026