EXPOSURES › CVE-2025-54313

CVE-2025-54313

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2026-01-22 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-54313 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 90/100 exploited-in-wildransomware-linked

Prettier eslint-config-prettier package executes malicious code on installation

Prettier eslint-config-prettier shipped a package with an embedded script that, upon installation, launches malware on Windows, posing a significant security risk to users.

Shame score — Embedded malicious code executed on installation, leading to a severe security breach.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Prettier · vendor eslint-config-prettier · product

DESCRIPTION

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.