CVE-2026-41211: Vite+ path traversal in downloadPackageManager() allows writes outside VP_HOME
CVE-2026-41211 affects Vite+ before 0.1.17, where downloadPackageManager() in the vite-plus/binding package uses an untrusted version string directly in filesystem paths. According to the record, a caller can escape the package manager cache root under VP_HOME and alter directories outside it. NVD assigns a CVSS score of 10 and GitHub assigns 8.4, and version 0.1.17 contains the patch.
Overview
CVE-2026-41211 is a path traversal weakness (CWE-22) in the downloadPackageManager() function of the vite-plus/binding package, as described in the record. The function accepts a version string that is not treated as trusted and uses it when building filesystem paths. According to the description, this can move file operations outside the intended package manager cache under VP_HOME.
Impact
- The description states that affected code can delete, replace and populate directories outside the intended cache location.
- The NVD record gives a CVSS score of 10 with integrity and availability impact rated high and confidentiality impact rated none.
- GitHub's record gives a score of 8.4.
- SSVC data in the record lists technical impact as total, while automatable is listed as no.
Affected products and versions
The record lists two product entries: Voidzero Vite+ before 0.1.17, and Voidzero-dev Vite-plus with a version before 0.1.17. The description says that version 0.1.17 contains a patch.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC field in the record shows exploitation as poc, which indicates a proof-of-concept condition and does not confirm active attacks. The GitHub advisory reference carries an Exploit tag in the record, but its content was not reviewed for this analysis.
Remediation and mitigation
- Upgrade Vite+ to version 0.1.17 or later, which the description identifies as containing the patch.
- Review the GitHub Security Advisory GHSA-33r3-4whc-44c2 for vendor mitigation details, since the record lists that advisory as a mitigation reference.
- Until upgrading is possible, avoid passing version values from untrusted sources into package manager download logic, and limit which users or pipelines can trigger it.
Detection guidance
- Check whether Vite+ builds or developer environments run versions before 0.1.17.
- Monitor for file changes outside the VP_HOME cache directory during dependency installation or package manager download steps.
- Review build scripts, CI configuration and tooling inputs for dynamic version values that could originate from outside the organization.
Limitations of the available information
The record does not provide proof-of-concept details, a full technical root-cause analysis or the exact patch diff. The EPSS date in the record (2026-10-23) is later than the publication date (2026-04-23), so its timing should be verified against the source before relying on it. The record does not describe the specific deployment conditions required for exploitation.
Frequently asked questions
Which versions of Vite+ are affected by CVE-2026-41211?
The record lists Vite+ versions before 0.1.17 as affected. Version 0.1.17 is stated to contain the patch.
Is CVE-2026-41211 known to be exploited in the wild?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted. The SSVC field shows a proof-of-concept indicator only.
What should teams do first?
Upgrade Vite+ to version 0.1.17 or later, review the GitHub advisory GHSA-33r3-4whc-44c2 for mitigation details, and restrict untrusted inputs to package manager download logic until upgrading is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.