# CVE-2026-41211: vite-plus path traversal in downloadPackageManager()

Source: https://junglewise.ai/threats/cve-2026-41211-voidzero-dev-vite-plus-path-traversal-in-downloadpackagemanager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41211 · Severity: critical · CVSS 10 · Published 2026-04-23

Vite+ is a unified development toolchain that manages runtimes, package managers, and frontend tools. A vulnerability in the downloadPackageManager() function allows code running in the same Node.js process to escape the package cache directory and write arbitrary files to other locations on the filesystem. This could be exploited to overwrite critical files or inject malicious executables, though normal command-line usage is protected by input validation.

Technologies: [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41211 being exploited in the wild.

**How severe is CVE-2026-41211?** Critical severity, with a CVSS score of 10, published 23 April 2026.

**Which products and versions are affected?** vite-plus (npm) SEMVER:introduced=0,fixed=0.1.17.

**Is there a fix for CVE-2026-41211?** Yes. vite-plus (npm): upgrade to 0.1.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41211 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-41211?** Check whether you run vite-plus (npm) or Voidzero Vite\+ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vite-plus (npm): upgrade to 0.1.17 or later

  ```sh
  npm install vite-plus@0.1.17
  ```


## Technical details

The vulnerability is a path traversal (CWE-22) in the downloadPackageManager() function exported from vite-plus/binding. The function accepts a version parameter and uses it directly to construct filesystem paths under VP_HOME/package_manager/<pm>/ without validating that it is a proper semantic version. An attacker can supply path traversal sequences like ../../../escaped to escape the cache root. After download and extraction, the function deletes any pre-existing directory at the computed target, extracts the package, and writes executable shim files—all at the attacker-controlled location outside VP_HOME. The CLI itself is protected because it validates versions via semver::Version::parse() before calling this code, but direct programmatic callers to the binding export can pass untrusted input. Exploitation requires the attacker to already be executing code in the same Node.js process and influence downloadPackageManager() input; no known real-world exploitation has been reported. The vulnerability is fixed in version 0.1.17.

## Affected products

- voidzero vite-plus <= 0.1.16

## Identifiers

- CVE-2026-41211
- GHSA-33r3-4whc-44c2

## Timeline

- 2026-04-16: disclosed: GHSA-33r3-4whc-44c2 published
- 2026-04-16: patched: Fix released in version 0.1.17

## References

- [https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2](https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2)
- [https://github.com/voidzero-dev/vite-plus](https://github.com/voidzero-dev/vite-plus)

## Related threats

- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [launch-editor command injection in editor invocation](https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in)