Threats affecting pkg:npm/vite-plus

Vite dev server on Windows improperly restricts access to files specified in server.fs.deny due to bypasses using NTFS alternate data streams and 8.3 short names. This allows an attacker to retrieve sensitive files like .env or TLS certificates if the server is exposed to the network and the files are in allowed directories. The issue affects multiple versions prior to fixed releases and has a medium severity rating.

CVE-2026-41211 is a path traversal vulnerability in vite-plus versions prior to 0.1.17. The function downloadPackageManager() improperly handles an untrusted version string, allowing an attacker to supply path segments like '.. /' or absolute paths. This can cause vite-plus to delete, replace, or populate directories outside its intended cache location. The vulnerability has a high severity with a CVSS score of 8.4. A patch was introduced in version 0.1.