CVE-2026-86063: Claude Code plugin install could skip a pinned commit hash

Vulnerability · Claude Code · HIGH

Incident dateNot stated

DisclosedOct 9, 2026 (Anthropic advisory). NVD published Oct 13, 2026.

Added hereOct 14, 7:35 AM ET

Last verifiedOct 14, 2026

Summary

Anthropic published advisory GHSA-pq7j-f95f-qfcv for the plugin install flow in Claude Code and Claude Desktop. When a marketplace pinned a plugin to a 40-character commit SHA, the installer ran git checkout on that value but never checked that the result matched the pin. An attacker who controlled the plugin's repository could create a branch named exactly like the pinned SHA, and the install would pull the branch tip instead of the reviewed commit. Claude Code 2.1.179 fixes it, and Anthropic says standard auto-update users already have it.

Severity

HIGH Attacker-controlled code installed in place of a commit the user reviewed and pinned. It needs a user to install the malicious plugin, pin it to a safe hash, and a git host that allows SHA-shaped branch names. NVD lists CVSS 4.0 7.5 High.

Timeline

Jun 16, 2026
Claude Code 2.1.179 is released on GitHub. Anthropic's advisory lists it as the patched version.
Oct 9, 2026
Anthropic publishes GHSA-pq7j-f95f-qfcv for @anthropic-ai/claude-code: versions before 2.1.179 affected.
Oct 13, 2026
NVD publishes CVE-2026-86063.

How it happened

git checkout accepts both commit hashes and branch names. If a branch carries the same 40-character name as the pinned commit, checkout can resolve to the branch, so the pin alone did not guarantee which code was installed. The fix is to confirm that HEAD equals the pinned SHA after checkout. Anthropic classifies it as CWE-494 and CWE-829 and credits Or Nevo Michrowski of Air Security. Note: NVD shows a score of 7.5 (user interaction: active), while the GitHub advisory page currently shows 7.7 (user interaction: passive). Both rate it High.

How to check your app

Run claude --version and make sure you are on 2.1.179 or later.
Only install plugins whose repository and maintainer you trust. A pinned hash did not protect you on older versions.
Review plugins you installed before 2.1.179 and reinstall them on a fixed version if in doubt.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.