{"id":"CVE-2026-86063","kind":"vulnerability","aliases":["CVE-2026-86063","GHSA-pq7j-f95f-qfcv"],"related":[],"title":"Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning","description":"The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.\r\n\r\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\r\n\r\nThank you to Or Nevo Michrowski of Air Security for reporting this issue.","summary":"Claude Code's plugin install flow checked out a marketplace's pinned commit with git checkout without confirming the resulting HEAD matched the pinned SHA. A malicious plugin repository could create a branch named like the pinned SHA, so the reviewed commit was silently replaced with attacker-controlled code.","severity":"high","cvss":7.7,"epss":0.00196,"exploited":false,"exploited_at":null,"products":[{"name":"@anthropic-ai/claude-code","fixed":["2.1.179"],"affected":"< 2.1.179","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","claude-code","cwe-494","cwe-829","developer-tools","npm","plugins"],"not_affected_if":["no-third-party-plugins","version-2.1.179-or-later"],"how_to_check":"- Run `claude --version` and compare against `2.1.179`.\n- Check whether `@anthropic-ai/claude-code` is installed globally with `npm ls -g @anthropic-ai/claude-code`.\n- Review installed plugins and their marketplace sources for untrusted repositories.","fix":"- `@anthropic-ai/claude-code` fixed in `2.1.179`; move to that version or later.","status":"open","published_at":"2026-10-09T15:14:01+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T22:59:14+00:00","updated_at":"2026-11-09T22:59:14+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:59:14Z","model":"claude-haiku-5-5","output":{"fix":"- `@anthropic-ai/claude-code` fixed in `2.1.179`; move to that version or later.","reach":"internet","title":"Claude Code: plugin hash pin bypass lets attacker-controlled plugin code install","impact":"high","summary":"Claude Code's plugin install flow checked out a marketplace's pinned commit with git checkout without confirming the resulting HEAD matched the pinned SHA. A malicious plugin repository could create a branch named like the pinned SHA, so the reviewed commit was silently replaced with attacker-controlled code.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["claude-code","npm","plugins","developer-tools"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker-controlled plugin code runs on the developer's machine","analyst_note":"","how_to_check":"- Run `claude --version` and compare against `2.1.179`.\n- Check whether `@anthropic-ai/claude-code` is installed globally with `npm ls -g @anthropic-ai/claude-code`.\n- Review installed plugins and their marketplace sources for untrusted repositories.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.1.179-or-later","no-third-party-plugins"],"who_is_affected":"Teams that install Claude Code plugins from marketplaces and rely on commit-SHA pinning to vet them. Exposure requires a user to install a malicious plugin and the plugin's git host to allow SHA-shaped branch names. Standard auto-update users have reportedly already received the fix; manual updaters need to update.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4916,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-494':34B '-829':36B '-86063':14A,22A '/claude-code':26A '40':140C 'advis':223C 'ai':25A,28B 'ai-tool':27B 'air':237C 'allow':7A 'alreadi':217C 'anthropic':24A 'anthropic-ai':23A 'attack':89B,124C,151C,163C 'attacker-control':88B,162C 'auto':211C 'auto-upd':210C 'branch':74B,134C,153C,203C 'bypass':6A,8A,168C 'caus':143C 'charact':141C 'check':48B,102C 'checkout':57B,112C,145C 'claud':1A,31B,42B,97C,100C,208C 'claude-cod':30B 'code':2A,32B,43B,91B,98C,165C,209C 'commit':54B,83B,108C,159C 'confirm':59B 'control':90B,125C,164C 'could':71B,131C 'creat':72B,132C 'cve':12A,20A 'cwe':33B,35B 'desktop':101C 'develop':38B 'developer-tool':37B 'exploit':172C 'f95f':18A 'fix':216C 'flow':47B,95C 'ghsa':16A 'ghsa-pq7j-f95f-qfcv':15A 'git':56B,111C,196C 'hash':4A,10A,171C,185C 'head':62B,118C 'host':193C,197C 'ident':136C 'instal':46B,94C,167C,177C 'instead':155C 'issu':242C 'latest':228C 'like':76B 'malici':68B,179C 'manual':220C 'marketplac':51B,105C 'match':63B,119C 'michrowski':235C 'name':75B,135C,204C 'nevo':234C 'npm':40B 'perform':219C 'permit':199C 'pin':5A,11A,53B,65B,78B,107C,121C,139C,170C,181C 'plugin':3A,41B,45B,69B,93C,127C,180C,189C 'pq7j':17A 'qfcv':19A 'receiv':214C 'replac':86B 'report':240C 'repositori':70B,130C 'requir':173C 'resolv':148C 'result':61B,117C,160C 'review':82B,158C 'safe':184C 'secur':238C 'sha':66B,79B,109C,122C,142C,201C 'sha-shap':200C 'shape':202C 'silent':85B,147C 'sourc':190C 'standard':207C 'thank':230C 'tip':154C 'tool':29B,39B 'updat':212C,221C,225C 'upstream':129C 'use':110C 'user':175C,205C,218C 'verifi':114C 'version':229C 'without':58B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams that install Claude Code plugins from marketplaces and rely on commit-SHA pinning to vet them. Exposure requires a user to install a malicious plugin and the plugin's git host to allow SHA-shaped branch names. Standard auto-update users have reportedly already received the fix; manual updaters need to update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["claudecode"],"ptokens":["ai","anthropic","claude","code"],"labels":["aitooling","claudecode","cwe494","cwe829","developertools","high","npm","plugins"],"campaign_type":null,"search_a":"'-2026':13A,21A '-86063':14A,22A '/claude-code':26A 'ai':25A 'allow':7A 'anthropic':24A 'anthropic-ai':23A 'bypass':6A,8A 'claud':1A 'code':2A 'cve':12A,20A 'f95f':18A 'ghsa':16A 'ghsa-pq7j-f95f-qfcv':15A 'hash':4A,10A 'pin':5A,11A 'plugin':3A 'pq7j':17A 'qfcv':19A","search_b":"'-494':34B '-829':36B 'ai':28B 'ai-tool':27B 'attack':89B 'attacker-control':88B 'branch':74B 'check':48B 'checkout':57B 'claud':31B,42B 'claude-cod':30B 'code':32B,43B,91B 'commit':54B,83B 'confirm':59B 'control':90B 'could':71B 'creat':72B 'cwe':33B,35B 'develop':38B 'developer-tool':37B 'flow':47B 'git':56B 'head':62B 'instal':46B 'like':76B 'malici':68B 'marketplac':51B 'match':63B 'name':75B 'npm':40B 'pin':53B,65B,78B 'plugin':41B,45B,69B 'replac':86B 'repositori':70B 'result':61B 'review':82B 'sha':66B,79B 'silent':85B 'tool':29B,39B 'without':58B","search_c":"'40':140C 'advis':223C 'air':237C 'alreadi':217C 'attack':124C,151C,163C 'attacker-control':162C 'auto':211C 'auto-upd':210C 'branch':134C,153C,203C 'bypass':168C 'caus':143C 'charact':141C 'check':102C 'checkout':112C,145C 'claud':97C,100C,208C 'code':98C,165C,209C 'commit':108C,159C 'control':125C,164C 'could':131C 'creat':132C 'desktop':101C 'exploit':172C 'fix':216C 'flow':95C 'git':111C,196C 'hash':171C,185C 'head':118C 'host':193C,197C 'ident':136C 'instal':94C,167C,177C 'instead':155C 'issu':242C 'latest':228C 'malici':179C 'manual':220C 'marketplac':105C 'match':119C 'michrowski':235C 'name':135C,204C 'nevo':234C 'perform':219C 'permit':199C 'pin':107C,121C,139C,170C,181C 'plugin':93C,127C,180C,189C 'receiv':214C 'report':240C 'repositori':130C 'requir':173C 'resolv':148C 'result':117C,160C 'review':158C 'safe':184C 'secur':238C 'sha':109C,122C,142C,201C 'sha-shap':200C 'shape':202C 'silent':147C 'sourc':190C 'standard':207C 'thank':230C 'tip':154C 'updat':212C,221C,225C 'upstream':129C 'use':110C 'user':175C,205C,218C 'verifi':114C 'version':229C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-09T15:14:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-pq7j-f95f-qfcv","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv","severity":"high","published_at":"2026-10-09T15:14:01+00:00","modified_at":"2026-10-09T15:14:01+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null},{"source":"ghsa","external_id":"GHSA-pq7j-f95f-qfcv","url":"https://github.com/advisories/GHSA-pq7j-f95f-qfcv","severity":"high","published_at":"2026-10-15T20:22:07+00:00","modified_at":"2026-10-15T20:22:08+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-86063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86063","severity":null,"published_at":"2026-10-13T19:21:21+00:00","modified_at":"2026-10-13T21:19:36+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110598,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-09T15:14:01+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110897,"url":"https://api.github.com/repos/anthropics/claude-code/security-advisories/GHSA-pq7j-f95f-qfcv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110899,"url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.179","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00196,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86063"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}