The vite-plus package has a path traversal vulnerability in its downloadPackageManager() binding function. This function accepts an untrusted version string and uses it directly in filesystem paths without validation, allowing a caller to escape the intended cache directory (VP_HOME) and write files outside it. Normal CLI usage is not affected because it validates version strings, but programmatic callers passing untrusted input can exploit this flaw. The vulnerability allows overwriting arbitrary directories outside VP_HOME, potentially leading to arbitrary file writes. A fix is available in vite-plus version 0.1.17.