PT-2026-34601

CVE-2026-41211

Published

2026-04-16

Updated

2026-04-23

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vite+ versions prior to 0.1.17

Description The downloadPackageManager() function accepts an untrusted version string and uses it directly in filesystem paths. This allows a caller to use absolute paths or ../ segments to escape the VP HOME/package manager/<pm>/ cache root, enabling the deletion, replacement, and population of directories outside the intended cache location.

Recommendations Update to version 0.1.17.

Exploitability

Exploit

Fix

Impacts

Researchers

Jvr2022

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers