CVE-2026-41211

The `downloadPackageManager()` function in `vite-plus/binding` is vulnerable to path traversal. It accepts an untrusted `version` string and uses it directly in filesystem paths without proper validation. This allows an attacker to supply `../` segments to escape the `VP_HOME/package_manager/<pm>/` cache root and cause Vite+ to delete, replace, and populate directories outside the intended cache location. A programmatic caller of `vite-plus/binding` can pass traversal strings such as `../../../escaped` and break out of `VP_HOME`. This can lead to attacker-controlled file write outside the intended install root, especially when combined with the supported custom-registry override (`npm_config_registry`).