---
id: "CVE-2026-86063"
page: "https://infrastack.ai/live/CVE-2026-86063"
kind: "vulnerability"
aliases: ["CVE-2026-86063", "GHSA-pq7j-f95f-qfcv"]
title: "Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning"
severity: "high"
cvss: 7.7
epss: 0.00196
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@anthropic-ai/claude-code", "fixed": ["2.1.179"], "affected": "< 2.1.179", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "claude-code", "cwe-494", "cwe-829", "developer-tools", "npm", "plugins"]
not_affected_if: ["no-third-party-plugins", "version-2.1.179-or-later"]
published_at: "2026-10-09T15:14:01+00:00"
first_seen_at: "2026-11-09T22:53:24+00:00"
updated_at: "2026-11-09T22:59:14+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv", "first_seen_at": "2026-11-09T22:53:24+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv", "first_seen_at": "2026-11-09T22:57:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86063", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00196, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-86063"}]
---

# Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Link for people: https://infrastack.ai/live/CVE-2026-86063 (this .md is for agents)

Claude Code's plugin install flow checked out a marketplace's pinned commit with git checkout without confirming the resulting HEAD matched the pinned SHA. A malicious plugin repository could create a branch named like the pinned SHA, so the reviewed commit was silently replaced with attacker-controlled code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@anthropic-ai/claude-code affected < 2.1.179 fixed 2.1.179

## How to check

- Run `claude --version` and compare against `2.1.179`.
- Check whether `@anthropic-ai/claude-code` is installed globally with `npm ls -g @anthropic-ai/claude-code`.
- Review installed plugins and their marketplace sources for untrusted repositories.

## Fix

- `@anthropic-ai/claude-code` fixed in `2.1.179`; move to that version or later.

## Timeline

- 2026-11-09T22:53:24+00:00 ghsa-repo https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
- 2026-11-09T22:57:50+00:00 ghsa https://github.com/advisories/GHSA-pq7j-f95f-qfcv
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86063

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/anthropics/claude-code/security-advisories/GHSA-pq7j-f95f-qfcv
- [fix] Release: github.com https://github.com/anthropics/claude-code/releases/tag/v2.1.179

## From the sources

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to Or Nevo Michrowski of Air Security for reporting this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_