Is CVE-2025-54313 (Prettier eslint-config-prettier Embedded Malicious Code) being exploited in the wild?

Yes. CISA added CVE-2025-54313 to its Known Exploited Vulnerabilities catalogue on 22 January 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What makes this an active exploitation case?

The key question is not whether the vulnerability exists, but whether there is evidence it is being used against real targets. For this CVE, CISA’s KEV listing is the practical signal that exploitation has moved beyond theory. That means defenders should assume exposure may already be discoverable by attackers and treat the issue as a live incident-prevention problem, not a routine patch-cycle item.

When a vulnerability is in the KEV catalogue, triage should shift from “is it serious?” to “where is it, how reachable is it, and what would compromise allow?” That matters especially for software delivery and development tooling, where malicious code can affect build integrity, dependency trust, and downstream consumers.

How to confirm whether you are exposed

Start by identifying every place the affected product is used, including developer workstations, CI pipelines, shared build images, package mirrors, and automation that may install it transitively. If you only look for direct application deployment, you can miss the environments where malicious code is most likely to execute.

The most useful check is a package inventory tied to build and release paths, not just runtime servers. That is why a vulnerability management guide is relevant here: for exploited software supply-chain issues, the important question is whether the vulnerable component exists anywhere it can influence trust, signing, packaging, or deployment.

Once you know where it appears, determine whether those environments can fetch or execute the package during an automated workflow. If the component is present only in dormant test assets, the response is still important, but the urgency and blast radius are different from an active production pipeline.

What to do if patching must wait

If you cannot remediate immediately, reduce the chance that the malicious code can execute or spread. That usually means isolating affected build paths, freezing dependency updates, limiting who can publish or approve changes, and blocking untrusted package sources until the fix is in place. In parallel, preserve logs from package install, build, and release systems so you can review whether the code was invoked earlier.

For exploited software, delayed patching is acceptable only when the workaround actually changes the attack path. If the vulnerable component still runs inside an automated trust chain, a compensating control that does not break that path may offer little real protection.

The Zero-Day and Exploited Vulnerabilities Guide is useful because it frames the right order of operations: exposure check, emergency mitigation, and post-remediation hunting. That sequencing matters more than trying to perfect attribution before you act.

Risk and Threat Considerations

An embedded malicious code issue can affect more than the host system. If the package is used in development, CI, or release automation, the compromise can reach build artifacts, credentials available to pipelines, internal repositories, and any downstream systems that trust the resulting output.

Failure mechanism: Malicious code embedded in a trusted package executes during installation or pipeline activity, allowing an attacker to manipulate the build path, harvest secrets, or alter software before it is distributed onward.

Impact: The result can be supply-chain compromise, poisoned releases, credential exposure, and a wider incident scope than the originally affected workstation or repository.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Exploited software needs rapid inventory, prioritization, and remediation.
Recommendation — Prioritise and remediate KEV-listed software through continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about responding to an actively exploited software flaw.
	CM-8 — System Component Inventory	You must locate every build and deployment instance of the affected package.
	SI-3 — Malicious Code Protection	Embedded malicious code requires controls that detect or block hostile payloads.
Recommendation — Accelerate flaw remediation for software identified as actively exploited. Maintain component inventory so you can find every affected installation quickly. Use malicious code protection to detect and block unsafe package execution.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploited software in build and dependency paths as higher priority than ordinary deferred remediation. If the component is reachable by automation, it deserves immediate owner attention even when the business impact is not yet visible.

What to verify: Confirm not only whether the package is installed, but whether it has executed in a workflow that could have exposed tokens, signing material, or release credentials. Review install history, pipeline logs, and dependency lockfiles for the affected window.

Decision rule: If the package participates in code generation, build, test, publish, or deployment, assume the blast radius includes both software integrity and secret exposure until proven otherwise. If it is isolated to a non-executing environment, the remediation still matters, but the compromise assessment can usually be narrower.

Practitioner takeaway: For exploited package-level malicious code, the real risk is often downstream trust compromise, so remediation and compromise review should be treated as one action, not two separate projects.