cve.bz

CVE-2025-54313

7.5 highKEVEPSS 5.1%

High (7.5) in Prettier eslint-config-prettier. In CISA KEV since 2026-01-22. EPSS 5.1% chance of exploitation in the next 30 days. Fixed in eslint-config-prettier 10.1.8, 8.10.2, 9.1.2.

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS
5.1% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2026-01-22, due 2026-02-12
CWE
CWE-506
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-f29h-pxvx-f335npmeslint-config-prettier>=8.10.1 <8.10.28.10.2
GHSA-f29h-pxvx-f335npmeslint-config-prettier>=9.1.1 <9.1.29.1.2
GHSA-f29h-pxvx-f335npmeslint-config-prettier>=10.1.6 <10.1.810.1.8
GHSA-f29h-pxvx-f335npmeslint-plugin-prettier>=4.2.2 <4.2.44.2.4
GHSA-f29h-pxvx-f335npmsynckit>=0.11.9 <0.11.100.11.10
GHSA-f29h-pxvx-f335npm@pkgr/core>=0.2.8 <0.2.90.2.9
GHSA-f29h-pxvx-f335npmnapi-postinstall>=0.3.1 <0.3.20.3.2
GHSA-f29h-pxvx-f335npmgot-fetch>=5.1.11 <6.0.06.0.0

References

Check your stackJSON