PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-54313 Prettier CVE debrief

CVE-2025-54313 is a CISA Known Exploited Vulnerabilities (KEV) entry affecting Prettier's eslint-config-prettier package. The supplied corpus describes it as an "Embedded Malicious Code Vulnerability" and indicates it was added to the KEV catalog on 2026-01-22 with a remediation due date of 2026-02-12. Because the provided source material is limited, the exact injection path, impacted versions, and exploitation details are not included here. Organizations that rely on eslint-config-prettier should treat this as a priority supply-chain/package integrity issue and verify whether they use affected package versions.

Vendor
Prettier
Product
eslint-config-prettier
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2026-01-22
Original CVE updated
2026-01-22
Advisory published
2026-01-22
Advisory updated
2026-01-22

Who should care

Security teams, JavaScript/Node.js maintainers, application developers, DevSecOps teams, and package management owners who depend on eslint-config-prettier or build systems that ingest it.

Technical summary

The available evidence identifies a malicious-code concern in the npm package eslint-config-prettier, associated with Prettier and tracked as CVE-2025-54313. CISA has listed it in KEV, which means the vulnerability is considered known to be exploited in the wild. The corpus does not provide technical root cause details, affected version ranges, or exploit mechanics, so validation should focus on whether the package is present in direct or transitive dependencies and whether installed versions match vendor guidance from the official package and advisories.

Defensive priority

High. KEV inclusion signals active exploitation risk and makes this a time-sensitive remediation item, especially for environments that consume the package directly or via build tooling.

Recommended defensive actions

  • Check whether eslint-config-prettier is used directly or transitively in any repositories, CI pipelines, or build images.
  • Review the official npm package versions and vendor guidance linked from the provided sources to determine whether your installed version is affected.
  • Upgrade, replace, or remove the package according to vendor instructions as soon as possible.
  • If mitigation is unavailable, discontinue use of the product or component in affected environments, consistent with CISA KEV guidance.
  • Rebuild and redeploy artifacts after remediation to ensure no compromised package version remains in lockfiles, caches, or artifact stores.
  • Add package integrity and dependency review checks to prevent recurrence in software supply chains.

Evidence notes

This debrief is based only on the supplied CISA KEV source item and the official links provided in the corpus. The source item names the issue as "Prettier eslint-config-prettier Embedded Malicious Code Vulnerability," records it as a KEV entry, and gives the dates added/due. No CVSS score, affected version range, or exploitation details were supplied in the corpus, so those specifics are intentionally not asserted here.

Official resources

Publicly listed by CISA as a Known Exploited Vulnerability on 2026-01-22. The supplied corpus does not include exploit mechanics or affected-version detail, so this debrief avoids unsupported technical claims.