Reject non-semver package manager versions
fix(install): reject non-semver package manager versions (#1386)
Reject non-semver package manager versionse159b8-fix-reject-non-semver-package-manager-versions-cve-2026-41211fixreject non semver package manager versions
Committed by fengmk2
commit message
fix(install): reject non-semver package manager versions (#1386)
Strictly validate the resolved version in `download_package_manager`
before it is interpolated into
`$VP_HOME/package_manager/{name}/{version}`.
`AbsolutePath::join` does not normalize `..`, so a version containing
path components could escape the home directory. The check also
covers registry-controlled `latest` lookups.
fixes
[GHSA-33r3-4whc-44c2](https://github.com/voidzero-dev/vite-plus/security/advisories/GHSA-33r3-4whc-44c2)Editor assessment
This commit patches CVE-2026-41211. The subject, fix(install): reject non-semver package manager versions, is precise, correctly scoped to the install code, and imperative. The body explains the vulnerability concisely: the resolved version is interpolated into a home-directory path, AbsolutePath::join does not normalize parent components, so a crafted version could escape the home directory, and the validation also covers registry-controlled latest lookups. That is exactly the motivation a reader needs, and the linked advisory footer is well formed. Clear, compact, and instructive.