voidzero-dev/vite-plus

voidzero-dev/vite-plus

GitHubGitHub
GitHubgithub.com
viteplus.devviteplus.dev
Releases128
Frequency1 day 9 hours
Last Release
Stars5.41K
Vite+ is the unified toolchain and entry point for web development. It manages your runtime, package manager, and frontend toolchain in one place.
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2026-41211NVD↗
< 0.1.1710 CRITICAL—

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.