Claude Code plugin hash pinning bypass vulnerability, versions before 2.1.179 affected
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
A GitHub security advisory discloses a hash pinning bypass vulnerability in the plugin installation flow of Claude Code and Claude Desktop (CVE-2026-86063): during installation, `git checkout` is used to retrieve the marketplace-pinned commit SHA, but the HEAD after checkout is not verified to match the pinned SHA. If an attacker controls the plugin's upstream repository, they can create a branch with the same name as the 40-character SHA, causing the checkout to silently resolve to the attacker's branch, thereby bypassing hash pinning and installing attacker-controlled code. Exploiting this vulnerability requires the user to install a malicious plugin and pin it to a secure hash, and the plugin source must be hosted on a git host that allows branch names shaped like SHAs. Affected versions are before @anthropic-ai/claude-code 2.1.179, fixed in 2.1.179; users on standard Claude Code auto-update have received the fix, while manual updaters need to upgrade to the latest version.
The advisory explains the specific mechanism by which the plugin installation flow fails to verify that HEAD matches the pinned SHA; teams using Claude Code plugins can use this to confirm whether they have updated to the fixed version.