Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.

Affected: npm: vite-plus

### Summary

`downloadPackageManager()` in `vite-plus/binding` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments to escape the `VP_HOME/package_manager/<pm>/` cache root and cause Vite+ to delete, replace, and populate directories outside the intended cache location.

### Details

The public `vite-plus/binding` export `downloadPackageManager()` forwards `options.version` directly into the Rust package-manager download flow without validating that it is a normal semver version.

That value is used as a path component when building the install location under `VP_HOME`. After the package is downloaded and extracted, Vite+:

1. computes the final target directory from the raw `version` string, 2. removes any pre-existing directory at that target, 3. renames the extracted package into that location, and 4. writes executable shim files there.

Because the CLI validates versions via `semver::Version::parse()` before calling this code, the protection that exists for normal `vp create`, `vp migrate`, and `vp env` flows does not apply to direct callers of the binding. A programmatic caller of `vite-plus/binding` can pass traversal strings such as `../../../escaped` and break out of `VP_HOME`.

### PoC

```js import fs from "node:fs"; import http from "node:http"; import os from "node:os"; import path from "node:path"; import { downloadPackageManager } from "vite-plus/binding";

const tgz = Buffer.from( "H4sIAH/B1GkC/+3…