CVE-2026-41211: Critical Path Traversal in Vite+ Package Manager Cache

CVE-2026-41211 is a critical path traversal (CVSS 10.0) in Vite+, the VoidZero web toolchain. Before version 0.1.17, a version string passed to its package manager download routine is used in file paths unchecked. That can delete, replace and populate folders outside the cache. Upgrade to 0.1.17.

What's affected

Vite+ before 0.1.17. The record names the function downloadPackageManager() and says version 0.1.17 contains the patch. The advisory is published in the voidzero-dev/vite-plus repository.

How to check if you're exposed

Find where Vite+ is installed. Search lockfiles and manifests in your repositories and CI images for the project name:

grep -R "vite-plus" package.json pnpm-lock.yaml package-lock.json yarn.lock 2>/dev/null

Check the package name against your own setup, since I could only confirm the repository name. Then compare the installed version with 0.1.17. Developer laptops and CI runners matter most, because the function acts on the local file system under the tool's home directory.

What to do now

1. Upgrade Vite+ to 0.1.17 or later in your projects and CI images.
2. Do not pass untrusted values, such as a version read from a pull request or a config file you do not control, into Vite+ commands on older versions.
3. Rebuild CI runner images so cached copies of the old version are gone.
4. Run a dependency scan across your repositories to find every place the toolchain is pinned.

Why it matters

The weakness is CWE-22, path traversal. The routine builds a directory under a cache root from a version string. If the string contains parent directory segments or an absolute path, the final location lands outside the root, and the tool then deletes and recreates what is there.

That is a destructive primitive. A build tool runs with the developer's rights, often with access to source, tokens and deploy keys. Treat inputs to build tooling as untrusted whenever they can come from a pull request, a fork or a shared config. The record does not flag this CVE as known exploited.

Quick check

Sources

• GitHub advisory GHSA-33r3-4whc-44c2

Last reviewed: 19 October 2026.