The vulnerability in vite-plus (voidzero-dev) exists because the downloadPackageManager() function uses an untrusted version string directly in filesystem paths without proper validation or sanitization. This allows an attacker to perform path traversal by including '../' sequences or absolute paths, escaping the VP_HOME/package_manager/<pm>/ cache root directory. Consequently, the attacker can cause the application to delete, replace, or populate directories outside the intended cache location. The issue is fixed in vite-plus version 0.1.17.

Exploitation of this vulnerability can lead to unauthorized modification or deletion of files outside the intended cache directory, potentially affecting system integrity or availability. The CVSS 4.0 score is 8.4 (high severity), indicating a significant impact if exploited locally. There is no indication of known exploits in the wild at this time.

Upgrade vite-plus to version 0.1.17 or later, where the vulnerability has been patched. Since this is a local vulnerability requiring supplying crafted input to the downloadPackageManager() function, applying the official fix is the recommended remediation. Patch status is not explicitly stated but the vendor fixed the issue in version 0.1.17, so upgrading is the primary mitigation.