CVE-2025-57754

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-57754

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57754.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-57754

Aliases

GHSA-2486-4cjg-pw98

Published

2025-08-21T16:14:29.391Z

Modified

2026-07-15T01:49:09.186051029Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)

Details

eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.

Database specific

{
    "cwe_ids": [
        "CWE-260"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57754.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/kristoferfannar/eslint-ban-moment

Affected ranges

Type

GIT

Repo

https://github.com/kristoferfannar/eslint-ban-moment

Events

Introduced

Fixed

bc2d2f9d23e6ae961a23e0d769e0722870b11108

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v2.*

v2.0.0

v3.*

v3.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57754.json"