{"id":"CVE-2026-41211","revision":"d34e161aeb8644c6a58507dc99b3d928","records":[{"revision":"d34e161aeb8644c6a58507dc99b3d928","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41211","aliases":[],"title":"`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`","description":"Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.","state":0,"publishedAt":"2026-04-23T00:56:15.568+00:00","modifiedAt":"2026-04-23T12:32:17.823+00:00","affected":[{"ecosystem":"Vendor product","name":"vite-plus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"voidzero-dev\",\n                    \"product\": \"vite-plus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.1.17\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":8.4,"severity":"HIGH"}],"references":["https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41211","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41211","identifiers":["CVE-2026-41211"]},"retained":false,"historicalAffected":[]}],"coverage":[]}