Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41211: vite-plus Path Traversal Escapes VP_HOME Cache https://thecybrdef.com/cve-2026-41211-vite-plus-path-traversal-vulnerability/ #CVE202641211 #PathTraversal #CyberSecurity
Post summary
A new path traversal vulnerability (CVE-2026-41211) in vite‑plus has been disclosed with basic technical details, but no PoC, exploit, or patch information is provided.
CVE-2026-41211 Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses i… https://www.cve.org/CVERecord?id=CVE-2026-41211
Post summary
The snippet mentions that Vite+ before version 0.1.17 accepts an untrusted version string, but provides no further exploitation, patch, or severity details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | voidzero | vite\+ | - | node.js | - |