CVE-2026-41211
Vite+ is a unified toolchain and entry point for web development.
Published Apr 23, 2026 · updated Jun 17, 2026 · voidzero vite+
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, accepts an untrusted string and uses it directly in filesystem paths. A caller can supply segments or an absolute path to escape the cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 23, 2026 · NIST NVD
Detected
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, accepts an untrusted string and uses it directly in filesystem paths. A caller can supply segments or an absolute path to escape the cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
Jun 17, 2026 · NIST NVD
Updated
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, accepts an untrusted string and uses it directly in filesystem paths. A caller can supply segments or an absolute path to escape the cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
Affected
- cpe voidzero/vite+version unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41211
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41211
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, accepts an untrusted string and uses it directly in filesystem paths. A caller can supply segments or an absolute path to escape the `VP_HOME/pack
nvd.nist.gov