CVE-2025-57754 eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
Attackers can access and modify Supabase database data due to hardcoded credentials exposed in the plugin's environment file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-57754?
CVE-2025-57754 is a critical vulnerability in kristoferfannar eslint-ban-moment, published on 21 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
Weakness: CWE-260
Which versions are affected by CVE-2025-57754?
How do I fix CVE-2025-57754?
No fix has been published for CVE-2025-57754 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-57754 being exploited?
There is no known exploitation of CVE-2025-57754 in the wild and no public exploit code.
Sources
Also known as GHSA-2486-4cjg-pw98.