CVE-2025-57754: eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57754?
CVE-2025-57754 is considered a critical vulnerability due to the exposure of sensitive Supabase URIs that can lead to unauthorized access to database and user data.
How do I fix CVE-2025-57754?
To fix CVE-2025-57754, upgrade the eslint-ban-moment plugin to version 3.1.0 or later to eliminate the exposure of sensitive data.
What does CVE-2025-57754 expose?
CVE-2025-57754 exposes sensitive Supabase URIs, including embedded usernames and passwords, in the .env file.
Which versions of eslint-ban-moment are affected by CVE-2025-57754?
Versions 3.0.0 and earlier of eslint-ban-moment are affected by CVE-2025-57754.
What can be the consequences of exploitation of CVE-2025-57754?
Exploiting CVE-2025-57754 can allow an attacker to gain complete unauthorized access and control over the affected database and user data.