CVE-2025-54313
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
Prettier eslint-config-prettier
CVSS
7.5HighExploit odds (EPSS)5.13%Chance of exploitation activity in the next 30 days, higher than 92% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
Description
Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Text from CVE List
Affected versions 4
- eslint-config-prettieraffected: 8.10.1CVE List
- eslint-config-prettieraffected: 9.1.1CVE List
- eslint-config-prettieraffected: 10.1.6CVE List
- eslint-config-prettieraffected: 10.1.7CVE List
References 12
- stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromiseAdvisoryvia CVE List
- bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/Exploitvia CVE List
- github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490Referencevia CISA KEV
- nvd.nist.gov/vuln/detail/CVE-2025-54313Referencevia CISA KEV
- socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromiseReferencevia CVE List
- github.com/prettier/eslint-config-prettier/issues/339Referencevia CVE List
- npmjs.com/package/eslint-config-prettier?activeTab=versionsReferencevia CVE List
- news.ycombinator.com/item?id=44609732Referencevia CVE List
- news.ycombinator.com/item?id=44608811Referencevia CVE List
- github.com/community-scripts/ProxmoxVE/discussions/6115Referencevia CVE List
- endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-onlyReferencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313Referencevia CVE List