HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2025-54313

CVSS 7.5v3.1pub. 2025-07-19upd. 2026-01-23

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Alexghr Got Fetch
APP
Alexghr
5.1.15.1.2
Homarr
APP
Homarr
1.29.0 – 1.30.0 (bez)
Microsoft Windows
OS
Microsoft
wszystkie wersje
Prettier Eslint Config Prettier
APP
Prettier
10.1.610.1.78.10.19.1.1
Prettier Eslint Plugin Prettier
APP
Prettier
4.2.24.2.3
Un Ts Napi Postinstall
APP
Un-Ts
0.3.1
Un Ts Pkgr\/core
APP
Un-Ts
0.2.8
Un Ts Synckit
APP
Un-Ts
0.11.9

CISA KEV — detailsi

Vendori: Prettier
Producti: eslint-config-prettier
Added to KEVi: January 22, 2026
Remediation deadline (US Federal)i: February 12, 2026(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

🔴