CVE-2026-41211 Details
Description
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
A path traversal vulnerability has been identified in Vite+ versions prior to 0.1.17. The issue arises in the `downloadPackageManager()` function within the `vite-plus/binding` module, where an untrusted `version` string is accepted and used directly in filesystem paths. This allows a caller to manipulate the version input with `../` segments or absolute paths to escape the designated cache root and execute unauthorized file operations outside of the intended directory. Exploitation of this vulnerability could lead to deletion, replacement, or unauthorized population of directories beyond the Vite+ cache location.
Users should update to Vite+ version 0.1.17 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| voidzero vite+ | < 0.1.17 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |