CVE-2026-86063
CVE-2026-86063 · Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
CVSS 7.5 · Élevée · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
claude-code
- Versions du logiciel
- < 2.1.179: Concernée
Aucun correctif publié
@anthropic-ai/claude-code npm
- Plages de versions concernées
- SEMVER: < 2.1.179
Mettez à jour vers 2.1.179