What’s Vulnerable › Vulnerabilities

CVE-2026-41211: `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-23 · updated 2026-10-26
• Weakness: CWE-22

Description

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.

Affected products

• Voidzero Vite+: before 0.1.17 — fixed in 0.1.17

How to fix

Upgrade to a fixed version: Voidzero Vite+ 0.1.17. Check the vendor advisory for mitigations.

References

• https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2
• https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2

Get alerted when CVE-2026-41211 or the next vulnerability affects your stack