CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Claude Code and Claude Desktopto a version that resolves this vulnerability.Fixed in 2.1.179
Event History
Frequently Asked Questions
Which installations are affected?
Claude Code and Claude Desktop plugin installation flows prior to version 2.1.179 are affected when installing a marketplace-pinned plugin from a repository hosted on a Git service that permits SHA-shaped branch names.
What does an attacker need to exploit this issue?
The attacker must control the plugin repository and create a branch whose name matches the reviewed 40-character commit SHA. A user must then install the malicious plugin while pinning it to that apparently safe hash.
Are users protected by pinning a plugin to a reviewed commit hash?
Not in affected versions. The installation flow checks out the specified value but does not verify that the resulting HEAD is the pinned 40-character SHA, so a matching branch name can cause attacker-controlled branch-tip code to be installed.
What is the remediation?
Upgrade to version 2.1.179, which fixes the issue. Until upgrading, avoid installing plugins from repositories that could be controlled by an attacker, even when they are pinned to a reviewed commit hash.