CVE-2025-54313

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.051 · 92 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 2 exploits · PoC

Likely / severe?

5.13% (92nd) EPSS

CVSS 7.5 · high

Is it mine?

27 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2026-01-22remediate by 2026-02-12

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highAV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Nsecondary · cve@mitre.org USexploitability 2.2 · impact 4.7

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Nsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-506USCWE-506USCWE-506US

exploits (2)

Public proof-of-concept and weaponised exploit code.

Paspke/scavenger_scannerDetect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on WindowsPoC · poc_in_github
nihilor/cve-2025-54313Checks projects for compromised packages, suspicious files, and import statements.PoC · poc_in_github

affected products (27)

Products and version ranges known to be affected.

prettier eslint-config-prettier≤ 10.1.7enisa_euvdEU
prettier eslint-config-prettier≤ 10.1.6enisa_euvdEU
prettier eslint-config-prettier≤ 8.10.1enisa_euvdEU
prettier eslint-config-prettier≤ 9.1.1enisa_euvdEU
Сообщество свободного программного обеспечения eslint-config-prettier≤ 10.1.7fstec_bduRU
Сообщество свободного программного обеспечения eslint-config-prettier≤ 9.1.1fstec_bduRU
Сообщество свободного программного обеспечения eslint-config-prettier≤ 8.10.1fstec_bduRU
alexghr got-fetch= 5.1.1nvdUScpe:2.3:a:alexghr:got-fetch:*:*:*:*:*:*:*:*
alexghr got-fetch= 5.1.2nvdUScpe:2.3:a:alexghr:got-fetch:*:*:*:*:*:*:*:*
homarr homarr1.29.0 → 1.30.0nvdUScpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*
prettier eslint-config-prettier= 10.1.6nvdUScpe:2.3:a:prettier:eslint-config-prettier:*:*:*:*:*:*:*:*
prettier eslint-config-prettier= 10.1.7nvdUScpe:2.3:a:prettier:eslint-config-prettier:*:*:*:*:*:*:*:*
prettier eslint-config-prettier= 8.10.1nvdUScpe:2.3:a:prettier:eslint-config-prettier:*:*:*:*:*:*:*:*
prettier eslint-config-prettier= 9.1.1nvdUScpe:2.3:a:prettier:eslint-config-prettier:*:*:*:*:*:*:*:*
prettier eslint-plugin-prettier= 4.2.2nvdUScpe:2.3:a:prettier:eslint-plugin-prettier:*:*:*:*:*:*:*:*
prettier eslint-plugin-prettier= 4.2.3nvdUScpe:2.3:a:prettier:eslint-plugin-prettier:*:*:*:*:*:*:*:*
un-ts napi-postinstall= 0.3.1nvdUScpe:2.3:a:un-ts:napi-postinstall:*:*:*:*:*:*:*:*
un-ts pkgr/core= 0.2.8nvdUScpe:2.3:a:un-ts:pkgr\/core:*:*:*:*:*:*:*:*
un-ts synckit= 0.11.9nvdUScpe:2.3:a:un-ts:synckit:*:*:*:*:*:*:*:*
npm @pkgr/core0.2.8 → 0.2.9osvUSpkg:npm/%40pkgr/core

showing 20 of 27

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-f29h-pxvx-f335eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code2025-07-19ghsa · osvUS
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2025-07-19modified 2026-08-07

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan