CVE-2026-41211
Critical
Description
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
SeverityCritical
CVSS10.0
Exploit probability—
ProductVoidzero Vite\+
PublishedApr 23, 2026
First seenApr 23, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- voidzero vite\+0.1.17 or later
- vite-plus0.1.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| voidzero vite\+ | v < 0.1.17 | 0.1.17 |
| vite-plusnpm | v < 0.1.17 | 0.1.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.