CVE-2025-54313

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-506

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 22, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-543142.8Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that CVE-2025-543157.1The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.CVE-2025-543164.9An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in f CVE-2025-543178.4An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creat CVE-2025-543196.3An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive infor CVE-2025-54329.8A vulnerability has been found in AssamLook CMS 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o CVE-2025-543204.3In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerabilit CVE-2025-543219.8In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerabi CVE-2025-543229.8Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The CVE-2025-543237.5An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and CVE-2025-543247.5An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330 CVE-2025-543255.3An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W92