plaincve:~$

// threat brief

CVE-2026-86063

Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installed instead

CVSS
7.5 HIGH
CISA KEV
Not listed
Weakness
CWE-494 · CWE-829
Topics
Supply chain · AI security

PlainCVE Team · Published 2026-10-19 · AI-assisted · Press brief ↓

AI review 2026-10-19 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Claude Code before 2.1.179 didn't confirm a plugin's pinned commit was what got checked out, so a hostile repo owner could swap in their own code.

Who is affectedDevelopers using Claude Code (npm package @anthropic-ai/claude-code) before 2.1.179. The vendor says Claude Desktop's plugin install flow is also affected but gives no version range. Exploitation also needs the plugin to be hosted on a Git host that allows branch names shaped like commit hashes.
What happensVendor's wording: attacker-controlled code can be installed even though the hash is pinned. Researchers describe it as remote code execution. News reporting notes that plugins run with the user's own access, which can reach files, stored credentials and systems they can log in to.
What to do nowUpdate Claude Code to 2.1.179 or later (the vendor says users on standard auto-update already have the fix). If you can't confirm you're patched, the Cloud Security Alliance (third-party advice) suggests turning off automatic plugin updates.
Affected versionsClaude Code before 2.1.179; Claude Desktop is affected but the vendor gives no version range
Fixed versionsClaude Code 2.1.179 or later
CVSS vector
Show full vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Timeline
  • First public 2026-10-09

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your Claude Code version

    Run this in a terminal on the computer where Claude Code is installed (read-only; it only checks the version on your own machine). The npm package @anthropic-ai/claude-code below 2.1.179 is in the affected range. `npm ls -g` only sees global npm installs; if you installed with the native installer, Homebrew, WinGet or similar, `npm ls` will find nothing, so go by the output of `claude --version`. The vendor gives no version range for Claude Desktop; keep it current.

    Read-only check
    claude --version; npm ls -g @anthropic-ai/claude-code
    Step 4
  2. 02Inventory where your plugins are hosted

    Researchers note GitHub rejects hash-shaped branch names while Bitbucket and self-hosted Git servers allow them. Plugins from the latter deserve a closer look first. This is PlainCVE's suggestion based on the researchers; the vendor gives no detection guidance.

    Step 1Step 2
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 2.1.179 or later

    The vendor says users on standard auto-update already have the fix; users who update manually should move to the latest version. Run this in a terminal on the computer where Claude Code is installed; this command **changes your environment** (it installs a new version). `claude update` is the manual update command the official docs give for native installs. The docs say npm global installs should use `npm install -g @anthropic-ai/claude-code@latest`, Homebrew `brew upgrade claude-code`, and WinGet `winget upgrade Anthropic.ClaudeCode` (these also change your environment). Afterwards, run `claude --version` and make sure it shows 2.1.179 or later.

    Changes your environment
    claude update
    Step 4
  2. 02Can't confirm you're patched: turn off plugin auto-update

    The Cloud Security Alliance (CSA) research note says turning off automatic plugin updates removes the zero-click part of the attack. This is third-party advice, not the vendor's.

    Step 3
RESPONDRespondIf you find signs of compromise
  1. 01Remove suspicious plugins and rotate credentials

    Plugins run with the user's own access. If you installed or updated a plugin from a non-GitHub host on an old version and can't vouch for its contents, PlainCVE suggests removing it and rotating the credentials reachable from that machine. This is a precaution; there are no reports of real-world exploitation.

    Step 5
HARDENHardenPrevent the next one
  1. 01Install plugins only from trusted sources

    The vendor says exploitation needs a user to install a malicious plugin; hash pinning is one safeguard, not a replacement for trusting the source.

    Step 1Step 3
  2. 02In your own tooling, verify after checkout

    The fix the researchers describe: after checkout, confirm the actual HEAD exactly equals the pinned hash, and abort the install if it doesn't.

    Step 4
Full remediation steps and notes
  1. Check your version and update. In a terminal on the computer where Claude Code is installed, run claude --version (global npm installs can also use npm ls -g @anthropic-ai/claude-code; other install methods won’t show up in npm ls). If it’s below 2.1.179, update to the latest version. The official docs give claude update for native installs and npm install -g @anthropic-ai/claude-code@latest for npm installs (both change your environment). The vendor says users on standard auto-update already have the fix.
  2. The release notes don’t mention this fix. News reporting says the 2.1.179 release notes don’t mention it at all, so you can’t rely on them to tell.
  3. Claude Desktop. The vendor gives no affected or fixed version; keep it up to date.
  4. If you can’t confirm you’re patched yet. CSA suggests turning off automatic plugin updates to remove the zero-click part (third-party advice).

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installed instead: 1. The attacker controls a plugin's upstream repository → 2. A branch with the same name as the pinned hash appears in the repository → 3. The user installs the plugin, or it auto-updates in the background → 4. Claude Code runs git checkout for the pinned hash but never checks the result → 5. The attacker's code is installed as the pluginCVE-2026-86063 · Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installedinsteadAttackerYour systemThe attacker controls a plugin's upstream repository — According to the vendor advisory, the plugin source must be on a Git host that allows branch names shaped like commit hashes. 1The attackercontrols aplugin's upstreamrepositoryA branch with the same name as the pinned hash appears in the repository — The vendor advisory says an attacker who controls the repository can make a same-named branch point to their own code. 2A branch with thesame name as thepinned hashappears in th…The user installs the plugin, or it auto-updates in the background — The vendor says a user must install the malicious plugin and pin it to the apparently safe hash; the researchers say plugin auto-update makes it zero-click. The sources disagree. 3The user installsthe plugin, or itauto-updates inthe backgroundClaude Code runs git checkout for the pinned hash but never checks the result — Older versions never confirmed that the resulting HEAD (the version actually checked out) equals the pinned 40-character hash, so the same-named branch can be checked out instead of the real commit. 4Claude Code runsgit checkout forthe pinned hashbut never check…The attacker's code is installed as the plugin — The plugin runs with the user's own access and can reach files, stored credentials and systems the user can log in to (as described in news reporting). 5The attacker'scode is installedas the pluginAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-86063-claude-code-plugin-pin-bypass · CC BY 4.0
Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installed instead: 1. The attacker controls a plugin's upstream repository → 2. A branch with the same name as the pinned hash appears in the repository → 3. The user installs the plugin, or it auto-updates in the background → 4. Claude Code runs git checkout for the pinned hash but never checks the result → 5. The attacker's code is installed as the pluginCVE-2026-86063 · Claude Code pluginhash-pin bypass: you pin a commit, butattacker code can be installed insteadThe attacker controls a plugin's upstream repository — According to the vendor advisory, the plugin source must be on a Git host that allows branch names shaped like commit hashes. 1AttackerThe attacker controls aplugin's upstream repositoryA branch with the same name as the pinned hash appears in the repository — The vendor advisory says an attacker who controls the repository can make a same-named branch point to their own code. 2AttackerA branch with the same name asthe pinned hash appears in therepositoryThe user installs the plugin, or it auto-updates in the background — The vendor says a user must install the malicious plugin and pin it to the apparently safe hash; the researchers say plugin auto-update makes it zero-click. The sources disagree. 3Your systemThe user installs the plugin,or it auto-updates in thebackgroundClaude Code runs git checkout for the pinned hash but never checks the result — Older versions never confirmed that the resulting HEAD (the version actually checked out) equals the pinned 40-character hash, so the same-named branch can be checked out instead of the real commit. 4Your systemClaude Code runs git checkoutfor the pinned hash but neverchecks the resultThe attacker's code is installed as the plugin — The plugin runs with the user's own access and can reach files, stored credentials and systems the user can log in to (as described in news reporting). 5AttackerThe attacker's code isinstalled as the pluginAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-86063-claude-code-plugin-pin-bypass
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker controls a plugin's upstream repository

    According to the vendor advisory, the plugin source must be on a Git host that allows branch names shaped like commit hashes.

    Defense: Install plugins only from sources you trust, and know which Git host each plugin comes from.

  2. Attacker

    A branch with the same name as the pinned hash appears in the repository

    The vendor advisory says an attacker who controls the repository can make a same-named branch point to their own code.

  3. Your system

    The user installs the plugin, or it auto-updates in the background

    The vendor says a user must install the malicious plugin and pin it to the apparently safe hash; the researchers say plugin auto-update makes it zero-click. The sources disagree.

    Defense: If you can't confirm you're patched, turn off automatic plugin updates (CSA's advice, third-party) to remove the zero-click path.

  4. Your system

    Claude Code runs git checkout for the pinned hash but never checks the result

    Older versions never confirmed that the resulting HEAD (the version actually checked out) equals the pinned 40-character hash, so the same-named branch can be checked out instead of the real commit.

    Defense: Upgrade to Claude Code 2.1.179 or later.

  5. Attacker

    The attacker's code is installed as the plugin

    The plugin runs with the user's own access and can reach files, stored credentials and systems the user can log in to (as described in news reporting).

    Defense: If you suspect a swapped plugin was installed, remove it and rotate credentials on that machine (PlainCVE suggestion).

Who is affected

ConditionAffected?
Claude Code (npm package @anthropic-ai/claude-code) before 2.1.179Affected
Claude Code 2.1.179 or laterFixed
Claude Desktop’s plugin install flowThe vendor says it’s affected but gives no version range
Plugin hosted on GitHubResearchers say GitHub rejects hash-shaped branch names, so this technique can’t be used
Plugin hosted on Bitbucket or a self-hosted Git serverResearchers say these hosts allow such names, which the attack needs

According to the vendor, exploitation also requires that the attacker controls the plugin’s upstream repository (where its source code lives), and that a user installs the malicious plugin and pins it to the apparently safe hash.

How it works

Claude Code’s plugin “marketplace” can pin a plugin to a commit hash (the 40-character ID Git gives each code change). The idea: even if the plugin author changes the code later, you still get the version that was reviewed.

The problem was that installation ran git checkout (the Git command that switches to a version) but never checked afterwards that the resulting HEAD (the version actually checked out) equalled the pinned hash. Branch names in Git are chosen by the repository owner. If the host allows it, an attacker can create a branch whose name is exactly that hash, so the checkout lands on the attacker’s code in that branch instead of the real commit. This maps to CWE-494 (download of code without integrity check) and CWE-829 (inclusion of functionality from an untrusted control sphere).

The flawed approach (conceptual illustration, not the original source code):

Show code example(text)
checkout(pinned_sha)
# assume we now have the pinned version and carry on installing

The fixed approach (as described by researchers):

Show code example(text)
checkout(pinned_sha)
if resolve(HEAD) != pinned_sha:
    abort_install()

The vendor has not described how it fixed the issue; the fix above comes from the CSA research note.

The sources disagree on whether user action is needed. The vendor and the CVE record say a user must install the malicious plugin and pin the hash. Air Security calls it zero-click, through background plugin auto-update. However, news reporting says background auto-update is on by default only for the built-in marketplaces, which live on GitHub. Combined with GitHub rejecting such branch names, our analysis is that the zero-click path may be more limited in default setups, though no source says this directly.

The impact wording also differs. The vendor says attacker-controlled code gets installed; the researchers call it remote code execution. News reporting notes that plugins run with the user’s own access, which can reach files, stored credentials and systems the user can log in to.

Timeline

DateEvent
2026-01-20A third-party release tracker says v2.1.14 added plugin commit-hash pinning; our analysis is the flaw may date from then, but the official range is just ”< 2.1.179”
2026-05Researchers build a working proof of concept (news reporting)
2026-06Air Security privately reports the flaw to vendors
June 16Date shown on the v2.1.179 GitHub release page (year not shown)
2026-06-17Anthropic confirms its fix (news, based on the researchers’ account)
2026-09-04CVE ID reserved
2026-09-17Air Security publishes its “Plugin4Shell” research on its own blog (third-party research, not a project announcement; the blog itself is dated the 17th, CSA restates it as the 18th, and we go by the original)
2026-10-09Anthropic advisory GHSA-pq7j-f95f-qfcv published; this is the project’s earliest public statement and the page’s first-disclosure date (earlier than the October 13 CVE record; neither the project’s issues nor the 2.1.179 release notes mention the flaw)
2026-10-13CVE record published; CISA SSVC rates exploitation as “none”
2026-10-14Not in CISA KEV; NVD status “Awaiting Analysis”

Further reading

  • Scoring differences: the CVE record (CNA) gives CVSS 4.0 7.5 with active user interaction (UI:A); the vendor GHSA gives 7.7 with passive user interaction (UI:P). NVD had not scored it as of October 14, so this page uses the CNA score.
  • Exploitation: not in CISA KEV, CISA’s SSVC says “none”, and news reporting found no sign of real attacks; there is no evidence of exploitation before a patch existed. Researchers did build a proof of concept.
  • Link to Plugin4Shell: the reporter, flaw and fixed version all match Air Security’s “Plugin4Shell” research, which also covered Codex, GitHub Copilot and Gemini CLI. But no source explicitly ties this CVE ID to Plugin4Shell, and CSA said no CVE existed at disclosure; treating them as the same is our analysis.
  • Global GitHub Advisory Database: when queried on 2026-10-17 it had a reviewed entry, GHSA-pq7j-f95f-qfcv (added 2026-10-15), with CVSS 4.0 7.5 (UI:A, same as the CNA), covering @anthropic-ai/claude-code below 2.1.179 and fixed in 2.1.179. The vendor advisory in the Claude Code repository gives 7.7 (UI:P).
  • Sources we don’t link: Air Security’s “Plugin4Shell” research post, the Cloud Security Alliance (CSA) research note and The Next Web’s report all lay out the attack steps for this flaw in order (the page contains attack code; we don’t link it). Where this page cites them, it names the source only.
  • Related weakness types: CWE-494, CWE-829.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-19 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryGHSA-pq7j-f95f-qfcv — Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code · Anthropic (GitHub), 2026-10-09 · accessed 2026-10-14
  2. CVE / NVD / OSVCVE-2026-86063 record · CVE Program, 2026-10-13 · accessed 2026-10-14
  3. CVE / NVD / OSVNVD API - CVE-2026-86063 · NIST · accessed 2026-10-14
  4. Patch / releaseClaude Code v2.1.179 release · Anthropic (GitHub) · accessed 2026-10-14
  5. OtherClaude Code docs - Advanced setup (update Claude Code) · Anthropic · accessed 2026-10-14
  6. NewsPlugin4Shell: AI coding agents Claude Code, Codex, Copilot, Gemini CLI · aicybr · accessed 2026-10-14
  7. OtherClaude Code 2.1.14 release summary · Havoptic · accessed 2026-10-14
  8. OtherGitHub Advisory Database query for CVE-2026-86063 · GitHub · accessed 2026-10-17

Press brief

In one sentence

Claude Code is Anthropic's AI coding agent. When installing plugins it let users "pin" a plugin to a specific version, but never checked that the version actually installed was the pinned one, so an attacker controlling a plugin's repository on a Git host that allows hash-shaped branch names (researchers say GitHub does not) could swap in their own code, if, according to Anthropic, a user installed and pinned that plugin (the researchers say auto-update can make it zero-click). Anthropic fixed it in version 2.1.179, and its advisory was published on October 9, 2026. There are no reports of real-world exploitation, and it is not in CISA's Known Exploited Vulnerabilities catalog.

Key facts

Severity
CVSS 4.0 7.5 (CNA); vendor GHSA gives 7.7 cveawg.mitre.org
Fixed version
Claude Code 2.1.179 github.com
Vendor advisory published
2026-10-09 (GHSA-pq7j-f95f-qfcv) github.com
Reported by
Or Nevo Michrowski of Air Security github.com
Exploitation
CISA SSVC rates it 'none' (2026-10-13) cveawg.mitre.org

Confirmed

  • The Claude Code and Claude Desktop plugin install flows did not confirm the checked-out HEAD matched the pinned hash (vendor).
  • Fixed in Claude Code 2.1.179; users on standard auto-update already have it (vendor).
  • As of 2026-10-14 it is not in CISA KEV, and CISA's SSVC rates exploitation as 'none'.

Unconfirmed / disputed

  • Whether user action is needed: the vendor and CVE record say a user must install and pin the plugin; the researchers say auto-update makes it zero-click.
  • Impact wording: researchers call it remote code execution; the vendor advisory says attacker code gets installed.
  • No source explicitly links this CVE to Air Security's "Plugin4Shell" research; treating them as the same is PlainCVE's analysis.
  • The vendor gives no affected version range for Claude Desktop; the researchers' blog is dated September 17, while CSA restates it as September 18.

Quotable line

Pinning a version is only a promise; if nobody checks what actually arrived, the promise can be quietly broken.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installed instead". PlainCVE. https://plaincve.date/en/vulns/cve-2026-86063-claude-code-plugin-pin-bypass (accessed YYYY-MM-DD)
BibTeX
@misc{cve202686063claudecodepluginpinbypass2026,
  title  = {Claude Code plugin hash-pin bypass: you pin a commit, but attacker code can be installed instead},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-86063-claude-code-plugin-pin-bypass},
  note   = {Updated 2026-10-19}
}