CVE-2026-41211

CVE-2026-41211 is a path traversal vulnerability in Vite+ versions prior to 0.1.17 that allows an attacker to manipulate the downloadPackageManager() function by supplying a crafted version string containing directory traversal sequences (such as ../). This vulnerability affects the web development toolchain by enabling unauthorized access to and modification of directories outside the intended cache location at VP_HOME/package_manager/<pm>/. The vulnerability exhibits a moderately exploitable attack profile with a local attack vector and appears to require some interaction or precondition for successful exploitation. If leveraged, an attacker could delete, replace, or populate arbitrary directories on the affected system, potentially leading to system compromise, code execution, or denial of service depending on file system permissions and system configuration. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. With an EPSS score of 0.00014 and a FAUCET Risk Score of 41/100, the vulnerability poses minimal immediate threat from a community exploitation perspective. Organizations using Vite+ should upgrade to version 0.1.17 or later to remediate this issue, though the low threat indicators suggest non-urgent patching priority.