Paper/Archive/CVE-2026-41211

CVE-2026-41211

voidzero-dev vite-plus — `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

EPSS 0.3%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (NVD)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 24.0.240 × 204.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.

Affected

ProductAffectedFixed inSource

vite-plus< 0.1.17–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

GitHub_M (CNA)8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2