@eslint/plugin-kit (npm)
Monorepo for the new version of ESLint
Advisories
3
Latest version
0.7.3
Released Sep 3, 2026
License
Apache-2.0
OpenSSF Scorecard
—
How to fix
Upgrading to 0.3.4 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @eslint/plugin-kit@0.7.3yarn
yarn add @eslint/plugin-kit@0.7.3pnpm
pnpm add @eslint/plugin-kit@0.7.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xffm-g5w8-qvg7 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser |
Low | < 0.3.4 | 0.3.4 |
| GHSA-xffm-g5w8-qvg7 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser |
Low | < 0.3.4 | 0.3.4 |
| GHSA-7q7g-4xm8-89cq Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit |
High EPSS 0.51% |
< 0.2.3 | 0.2.3 |
Source: git+https://github.com/eslint/rewrite.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor