VYPR
Get started
← All advisories
Critical severity9.8OSV Advisory· Published Aug 21, 2025· Updated Apr 15, 2026

CVE-2025-57754

CVE-2025-57754

Description

eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.

Affected products

1

Patches

1
bc2d2f9d23e6

address GHSA-2486-4cjg-pw98

https://github.com/kristoferfannar/eslint-ban-momentKristófer Fannar BjörnssonAug 21, 2025via osv
commit
2 files changed · +2 −3
  • .env.example+0 −2 removed
    @@ -1,2 +0,0 @@
-
-SUPABASE_URI=postgresql://postgres:Occupant-Blubber-Supply6@db.dxnmjuwbxnwpperukhfi.supabase.co:5432/postgres
  • .gitignore+2 −1 modified
    @@ -78,6 +78,7 @@ web_modules/
 .env.test.local
 .env.production.local
 .env.local
+.env.example
 
 # parcel-bundler cache (https://parceljs.org/)
 .cache
@@ -130,4 +131,4 @@ dist
 .pnp.*
 
 
-.DS_Store
\ No newline at end of file
+.DS_Store

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.