Vite+ is a web development toolchain that, before version 0.1.17, allowed callers to trigger the function downloadPackageManager() with an untrusted version string. The function used that string directly to construct filesystem paths inside VP_HOME/package_manager/<pm>/, but it did not sanitize or resolve relative components. A malicious caller can embed ‘../’ segments or an absolute path, causing the function to write to arbitrary locations outside the intended cache directory. These writes can delete, replace, or populate directories that are not part of the VP_HOME tree, potentially compromising the host filesystem or installing arbitrary code.

Affected product is vite-plus from the voidzero-dev repository. Versions released before 0.1.17 are vulnerable. Later releases, including 0.1.17 and above, incorporate a patch that sanitizes the input path.

The CVSS score of 8.4 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Because the function accepts a user‑provided parameter, the attack can be carried out by any caller that can invoke downloadPackageManager(). If the tool is exposed through a network service, remote actors could exploit it; otherwise, an attacker with local access could craft the request. The primary vector is a malicious input supplied to the downloadPackageManager() function, leading to path traversal and arbitrary file writes.