CVE-2026-86063: Claude Code's Pinned Plugin SHA Check Could Be Bypassed With a Branch Name

Claude Code and Claude Desktop installed marketplace plugins by running git checkout on a pinned commit SHA, but did not check that the resulting HEAD was that commit. A plugin repository owner could create a branch named after the reviewed SHA and get different code installed. The flaw is CVE-2026-86063 (GHSA-pq7j-f95f-qfcv), fixed in @anthropic-ai/claude-code 2.1.179; GitHub, as CNA, rates it high, at CVSS 4.0 7.5 in NVD and 7.7 in the advisory.

What happened

GitHub published the advisory on 9 October 2026, and NVD published CVE-2026-86063 on 13 October. The NVD record is still marked Awaiting Analysis, so the only score on it is the CNA's. The GitHub advisory is titled "Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code" and credits Or Nevo Michrowski of Air Security. Per the record, the plugin installation flow in Claude Code and Claude Desktop runs git checkout for the commit a marketplace pins, without verifying that the resulting HEAD equals the pinned 40-character SHA.

The fix shipped in Claude Code 2.1.179, released on 16 June 2026. The release notes for that version contain no security entry and do not mention plugin pinning; the only plugin line is "Improved plugin loading performance in remote sessions". The advisory (9 October) and CVE (13 October) appeared almost four months after the fix. The sources do not explain the gap.

The advisory says users on standard Claude Code auto-update have already received the fix, and advises users who update manually to move to the latest version.

How it relates to Plugin4Shell

ThreatFrontier covered Plugin4Shell on 2 October: Air Security research showing that a branch named after a pinned SHA let a repo owner swap plugin code in Claude Code, Codex, Copilot and Gemini CLI. That article reported Claude Code patched in 2.1.179 and said no CVE had been assigned.

CVE-2026-86063 appears to be the Claude Code CVE for that work: the mechanism is the same, the fixed version is the same, and the advisory's credited reporter, Or Nevo Michrowski of Air Security, appears as "Or Nevo" among the authors of the Plugin4Shell post, which says Anthropic patched the bug after disclosure, in 2.1.179. That is our inference. The NVD record, the GitHub advisory and the release notes do not mention Plugin4Shell, and no source we found says the two are the same issue. Treat the link as likely, not confirmed. The other three agents have no CVE in these sources, and nothing here changes their status as reported in that article.

Who is exposed

• Claude Code users on npm @anthropic-ai/claude-code earlier than 2.1.179 who install plugins from marketplaces that pin plugin sources to a commit SHA. In practice that means people who pin Claude Code versions or update by hand: per the advisory, standard auto-update users already have the fix.
• Claude Desktop users. NVD lists the Desktop plugin install flow as affected. The sources we read give no fixed Desktop version, so confirm with Anthropic or the in-app update channel.

Exploitation needs the plugin author's repository to sit on a Git host that allows SHA-shaped branch names. Per Air Security, GitHub rejects a 40-hex branch name outright, and Anthropic's documentation lists Bitbucket and self-hosted git as valid marketplace backends. The CVE record says the user must install the malicious plugin and pin it to the apparently safe hash. Air Security describes a wider reach: the same checkout re-runs on background plugin auto-update, which it says is the default in Claude Code and Codex, so when a marketplace re-pins to a new SHA the swap can reach plugins that were already installed, with no user action. The CNA and the researchers frame this differently, and we cannot settle it from the sources. CISA's SSVC entry for the CVE, dated 13 October, records exploitation as none, automatable as no and technical impact as total. The CVE is not in CISA's Known Exploited Vulnerabilities catalog as of 14 October. Nothing in the sources reports exploitation in the wild.

Plugins already carry heavy privileges. As we reported in Claude Code Mods Are On by Default, and They Run Unsandboxed With Your Permissions, installed plugin code runs with the user's own permissions. That is why a failed pin matters: the pin is the reviewer's guarantee about what runs.

Technical details

A marketplace entry pins a plugin to a specific commit so reviewers can vouch for exactly that code. Git accepts a bare ref name in git checkout. Per Air Security's Plugin4Shell write-up, the attacker creates a branch whose name is the exact 40-hex pinned SHA and makes it the repository's default branch. A non-default branch is fetched only as a remote-tracking ref, and the checkout would fall back to the commit; with the default branch, git prefers the ref and only prints a "refname is ambiguous" warning. The installer then lands on the attacker's commit while the pin still reads as the reviewed one. The CVE record itself does not mention the default-branch condition. The client-side check that was missing is comparing HEAD with the pinned value after checkout.

The two scores differ in one metric. The NVD entry carries the CNA's vector with user interaction marked active (UI:A), and the advisory marks it passive (UI:P), which is why it scores 7.7 rather than 7.5. Both come from GitHub as CNA.

What defenders should do

1. Upgrade Claude Code to 2.1.179 or later. Standard auto-update users have it already, per the advisory; if you pin versions or update manually, check with claude --version; for npm installs, update @anthropic-ai/claude-code. (We also covered a different Claude Code symlink race.)
2. Update Claude Desktop through its normal update channel (we covered an earlier Claude Desktop Cowork flaw). We could not find a fixed Desktop version in the sources.
3. Audit plugins installed before the upgrade (background plugin auto-update can re-run the checkout, per Air Security), particularly those from third-party marketplaces and from repositories on self-hosted Git servers. Compare each installed plugin's checked-out commit with the SHA its marketplace entry pins. A mismatch means the code is not what was reviewed.
4. Review marketplace-side pins. Teams that run an internal marketplace should confirm that the host in use rejects or namespaces SHA-shaped branch names, though per Air Security GitHub-hosted repositories were not exposed, because GitHub rejects 40-hex branch names.
5. Remove plugins you cannot trace to a reviewed source (plugin supply chains have been hit before, as with the OpenClaw plugin credential worm), and treat anything they could reach as potentially exposed.

What is still unclear

• Whether CVE-2026-86063 is formally the same issue as Plugin4Shell. The sources do not say.
• Which Claude Desktop versions are fixed.
• Why the CVE and advisory were published months after the 2.1.179 release.
• Whether anyone exploited this before the fix. SSVC lists none, and no report says otherwise, but absence of reports is not proof.

Sources

• NVD: CVE-2026-86063
• GitHub Security Advisory GHSA-pq7j-f95f-qfcv
• Claude Code v2.1.179 release
• CISA Known Exploited Vulnerabilities catalog
• Air Security: Plugin4Shell