Skip to content
OpenAdvisories

Vendor

voidzero-dev

1 known vulnerabilities.

Products

vite-plus 1
All Critical High Medium Low Exploited only

1 result · Feed

  • High 8.4
    CVE-2026-41211

    `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

    Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to esc…

    voidzero-dev vite-plus vite-plus npm