VIR Vulnerability Intelligence Relay

CVE-2026-41211

critical
Published 2026-04-23 · Modified 2026-05-06
CVSS v3
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS v2
—
VIR risk
10.0

Description

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Predictions

Exploit likelihood
98%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2

Package impact
EcosystemPackageVulnerableFixed
npm npmvite-plus<0.1.170.1.17
npm NPMvite-plus<= 0.1.160.1.17

Application impact
VendorProductVersionsFixed
voidzerovite\+{"endExcluding":"0.1.17"}0.1.17

References

CWEs

CWE-22

Verify integrity in audit chain (admin only). AS-IS.