CVE-2026-41211: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41211 is a path traversal vulnerability in Vite+ (vite-plus), a unified toolchain and entry point for web development maintained by VoidZero. The downloadPackageManager() function in the vite-plus/binding package accepts an untrusted version string and uses it directly in filesystem paths without validation, allowing callers to supply ../ segments or absolute paths to escape the intended VP_HOME/package_manager/<pm>/ cache directory. All versions prior to 0.1.17 are affected. The vulnerability was published on April 23, 2026, with a patch released in version 0.1.17. It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The downloadPackageManager() function in vite-plus/binding forwards the options.version parameter directly into the Rust package-manager download flow without sanitizing path traversal sequences. This value is used as a path component when building the install location under VP_HOME; after downloading and extracting the package, Vite+ computes the final target directory from the raw version string, removes any pre-existing directory at that target, renames the extracted package into that location, and writes executable shim files there. Critically, while the CLI validates versions via semver::Version::parse() before calling this code, that protection does not apply to direct programmatic callers of the binding. Exploitation requires the attacker to be executing code in the same Node.js process and able to influence the version argument passed to downloadPackageManager() (GitHub Advisory).

Successful exploitation allows an attacker to delete, replace, and populate arbitrary directories outside the intended VP_HOME cache root, effectively enabling attacker-controlled file writes to any location accessible by the process. When combined with the supported npm_config_registry environment variable override, an attacker can supply a malicious package tarball via a custom registry and write its contents to an attacker-chosen path, potentially overwriting application code, system binaries, or configuration files to achieve arbitrary code execution or full system compromise. Integrity and availability are both severely impacted; confidentiality is not directly affected by this vulnerability (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the path traversal by calling downloadPackageManager() with a malicious version string (e.g., ../../../vite-plus-escape) and verifying successful directory escape via filesystem checks. The EPSS score is approximately 0.014% (0.000140), indicating low current probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The advisory notes that normal CLI usage is not affected, as exploitation requires the attacker to already be executing code in the same Node.js process and passing untrusted input directly to the binding API (GitHub Advisory).

1. Identify target: Confirm the target application programmatically imports vite-plus/binding and calls downloadPackageManager() with attacker-influenced input, in a version prior to 0.1.17.
2. Set up malicious registry: Stand up a local or remote HTTP server serving a crafted .tgz package tarball containing the files to be written to the target directory (e.g., a malicious executable or web shell).
3. Set registry override: Set the npm_config_registry environment variable to point to the attacker-controlled server, so Vite+ fetches the malicious package during the download step.
4. Craft malicious version string: Prepare a version string containing path traversal sequences, such as ../../../target-directory, designed to resolve to the desired write location outside VP_HOME.
5. Trigger the vulnerable function: Execute code within the same Node.js process that calls downloadPackageManager({ name: 'pnpm', version: '../../../target-directory' }), causing Vite+ to delete any existing directory at the resolved path, extract the malicious tarball there, and write shim files.
6. Achieve objective: Verify that attacker-controlled files now exist at the escaped path (e.g., overwritten application code or a planted executable), then trigger execution of the planted payload to achieve code execution (GitHub Advisory).

• File System: Unexpected directories or files created outside the VP_HOME/package_manager/ directory tree, particularly in parent directories relative to VP_HOME; presence of pnpm shim binaries or other package manager executables in unexpected filesystem locations; directories with names matching traversal patterns (e.g., vite-plus-escape) outside the cache root.
• Environment/Process: npm_config_registry environment variable set to an unusual or non-standard registry URL within a Node.js process running Vite+; unexpected outbound HTTP connections from the Vite+ process to unknown or internal IP addresses serving .tgz files.
• Logs: Node.js process logs showing calls to downloadPackageManager() with version strings containing ../, ..\, or absolute path segments; filesystem audit logs recording deletion and creation of directories outside VP_HOME by the Vite+ process (GitHub Advisory).

Upgrade Vite+ to version 0.1.17 or later, which contains a patch that validates the version string before using it in filesystem paths. As a workaround prior to patching, implement input validation in any code that calls downloadPackageManager() directly to reject version strings containing ../, ..\, or absolute path segments. Additionally, restrict filesystem permissions for the process running Vite+ to limit the scope of potential damage, and consider sandboxing or containerizing the Vite+ toolchain. Normal CLI usage via vp create, vp migrate, and vp env is not affected, as those paths validate versions via semver::Version::parse() before reaching the vulnerable function (GitHub Advisory).