Read the docs
TI-2026-29828 Aliases CVE-2026-41211GHSA-33r3-4whc-44c2

`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vite-plus (voidzero-dev): 0.1.17vite-plus (npm): 0.1.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
voidzero-devvite-plusbefore 0.1.170.1.17Patch availableCNA
—vite-plus (npm)before 0.1.170.1.17Patch availableGHSA-33r3-4whc-44c2
  • vite-plus Vendorvoidzero-dev Affected before 0.1.17 Fixed in 0.1.17 Patch available CNA
  • vite-plus (npm) Vendor— Affected before 0.1.17 Fixed in 0.1.17 Patch available GHSA-33r3-4whc-44c2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:*before 0.1.17VulnerableVoidzero
  • cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:* Versions before 0.1.17 Vulnerable ·Voidzero

Remediation

  • Fix · CNA vite-plus (voidzero-dev) Fixed in 0.1.17
  • Fix · GHSA-33r3-4whc-44c2 vite-plus (npm) Fixed in 0.1.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41211
  2. 2026-10-03 Alias added: GHSA-33r3-4whc-44c2

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2026-38634 Vite: `server.fs.deny` bypass on Windows alternate paths CVSS 4.0HIGH 8.2
  • TI-2026-28352 Vite has a Path Traversal in Optimized Deps `.map` Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-28351 Vite has a `server.fs.deny` bypass with queries CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences