{"id":"EUVD-2026-25163","enisaUuid":"5f4e5e57-887a-36f6-96a6-8c40f2e904f6","description":"Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/\u003cpm\u003e/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.","datePublished":"Apr 23, 2026, 12:56:15 AM","dateUpdated":"Apr 23, 2026, 12:32:17 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","references":"https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2\n","aliases":"CVE-2026-41211\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"ee3afbc0-aadb-385c-b506-f483e1945123","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 0.1.17"}],"enisaIdVendor":[{"id":"64e9771c-18fb-3f9b-825c-511d9a39f3e4","vendor":{"name":"voidzero-dev"}}],"enisaIdVulnerability":[{"id":"994c87be-965e-3bbe-8170-2055631aa4b1","vulnerability":{"id":"CVE-2026-41211","description":"Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/\u003cpm\u003e/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.","datePublished":"Apr 23, 2026, 12:56:15 AM","dateUpdated":"Apr 23, 2026, 12:32:17 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","references":"https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2\n","enisa_id":"EUVD-2026-25163\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"366d57ca-71b5-334b-bd24-7525b5184c9b","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 0.1.17"}],"vulnerabilityVendor":[{"id":"fe16da91-7df3-3549-bc13-e5472c204be6","vendor":{"name":"voidzero-dev"}}]}}],"enisaIdAdvisory":[]}