GHSA-pq7j-f95f-qfcv: Npm/@anthropic-ai/claude-code vulnerability
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Thank you to Or Nevo Michrowski of Air Security for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@anthropic-ai/claude-codeto a version that resolves this vulnerability.Fixed in 2.1.179
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Claude Code or Claude Desktop could be exposed when installing a malicious plugin whose upstream repository is controlled by an attacker and hosted on a Git service that allows branches named as 40-character SHA values.
What conditions are required for exploitation?
The user must install the malicious plugin and pin it to a seemingly safe commit hash. The attacker must control the plugin's upstream repository and create a branch whose name exactly matches that pinned 40-character SHA.
Are automatically updated Claude Code installations already fixed?
Yes. Standard Claude Code installations that use auto-update have already received the fix. Users who update manually should update to the latest version.
What should teams do if they cannot update immediately?
The provided information does not specify a workaround. Until updated, avoid installing untrusted plugins, particularly from attacker-controlled repositories on Git hosts that permit SHA-shaped branch names.