All vulnerabilities
CVE-2026-86063GHSA-pq7j-f95f-qfcv

@anthropic-ai/claude-code: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

anthropics @anthropic-ai/claude-codenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.1.179Fixed versionGitHub
Published13 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 2.1.179@anthropic-ai/claude-code, npmGitHubnpm install @anthropic-ai/claude-code@2.1.179

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to Or Nevo Michrowski of Air Security for reporting this issue.

Text from GitHub Advisory Database

Affected versions 3

  • @anthropic-ai/claude-code, npm< 2.1.179GitHub
  • claude-codeaffected: < 2.1.179CVE List
  • @anthropic-ai/claude-code, npmfrom first release, fixed in 2.1.179OSV

References 4