Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41211 is a path traversal vulnerability in the `downloadPackageManager()` function of the `vite-plus/binding` module (npm package `vite-plus`, versions up to 0.1.16). This function accepts a version string parameter that is used directly as part of a filesystem path under the `VP_HOME` directory without proper validation.

An attacker can supply a version string containing `../` segments or absolute paths to escape the intended cache directory `VP_HOME/package_manager/<pm>/`. This allows the attacker to delete, replace, or create files and directories outside the designated cache root.

The vulnerability arises because programmatic callers importing `vite-plus/binding` directly can bypass the usual CLI validation that prevents such traversal attacks. This can lead to arbitrary directory overwrites outside the intended cache directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with code execution within the same Node.js process to overwrite arbitrary directories outside the intended cache directory by manipulating the version string input.

Such unauthorized file system modifications could lead to deletion or replacement of important files, potentially causing denial of service, data loss, or unauthorized code execution if malicious files are placed.

However, normal CLI usage is not affected due to version string validation, and there are no known real-world exploitations or code paths exposing this vulnerability to untrusted input.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when the `downloadPackageManager()` function in vite-plus is called programmatically with an untrusted version string containing path traversal sequences such as `../`. Detection involves checking for unusual directory creations or modifications outside the expected `VP_HOME/package_manager/<pm>/` cache directory.

Since normal CLI usage validates version strings and is not vulnerable, detection should focus on programmatic usage of the vite-plus binding where untrusted input might be passed.

Suggested commands to detect potential exploitation or suspicious activity include:

• Searching for directories or files created outside the expected cache path, for example, using `find` to locate unexpected directories:
• ```bash find $VP_HOME/.. -type d -name '*vite-plus-escape*' ```
• Checking for recently modified or created files outside the cache directory:
• ```bash find $VP_HOME/.. -mtime -7 ```
• Reviewing logs or audit trails for calls to `downloadPackageManager()` with suspicious version strings containing `../` or absolute paths.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade vite-plus to version 0.1.17 or later, where the issue is patched.

Avoid programmatic calls to the `downloadPackageManager()` function with untrusted or user-supplied version strings.

Ensure that any input used as a version string is properly validated using semantic version parsing (e.g., `semver::Version::parse()`) before being passed to the function.

Restrict environment variables such as `npm_config_registry` to trusted values to prevent attacker-controlled package downloads.

Monitor filesystem activity around the `VP_HOME` directory for unexpected changes or directory creations outside the intended cache path.

Useful 0 Not Useful 0