@ANTHROPIC-AI/CLAUDE-CODE · CVE-2026-86063 · AI agents & MCP
FIX → 2.1.179
Claude Code's plugin install flow checked out a marketplace's pinned commit with git checkout without confirming the resulting HEAD matched the pinned SHA. A malicious plugin repository could create a branch named like the pinned SHA, so the reviewed commit was silently replaced with attacker-controlled code.
first public Oct 9, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that install Claude Code plugins from marketplaces and rely on commit-SHA pinning to vet them. Exposure requires a user to install a malicious plugin and the plugin's git host to allow SHA-shaped branch names. Standard auto-update users have reportedly already received the fix; manual updaters need to update.
Not affected if no-third-party-plugins, version-2.1.179-or-later
Who cares claude-code, developer-tools, npm, plugins
claude --version and compare against 2.1.179.@anthropic-ai/claude-code is installed globally with npm ls -g @anthropic-ai/claude-code.Upgrade to 2.1.179
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Thank you to Or Nevo Michrowski of Air Security for reporting this issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@anthropic-ai/claude-code fixed in 2.1.179; move to that version or later.This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.