CVE-2026-41211

The record

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.

Affected packages

Related vulnerabilities

• GHSA-33r3-4whc-44c2 Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME Same vulnerability
• CVE-2026-53571 Vite is a frontend tooling framework for JavaScript. Also affects vite-plus
• CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js. Also affects vite-plus
• GHSA-g8mr-85jm-7xhm Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files… Also affects vite-plus
• GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Also affects vite-plus
• GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths Also affects vite-plus
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
• CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22