voidzero-dev/vite-plus

voidzero-dev/vite-plus

GitHubGitHub
GitHubgithub.com
viteplus.devviteplus.dev
Releases122
Frequency1 day 2 hours
Last Release
Stars4.83K
Vite+ is the unified toolchain and entry point for web development. It manages your runtime, package manager, and frontend toolchain in one place.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-41211↗
10 CRITICAL—

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.