CVE-2026-86063
7.5HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
- Impact
- Full C/I/A compromise
- Weakness
- CWE-494, CWE-829
Impact
Attackers can run arbitrary code by having a user install and pin a malicious plugin repository. The attacker needs to control the upstream repository and create a branch named identically to the target commit SHA.
Root cause
The plugin installer runs git checkout on a pinned commit SHA without verifying that HEAD actually matches the expected 40-character hash, allowing a colliding branch name to take precedence.
Affected systems
Claude Code and Claude Desktop plugin installations prior to 2.1.179
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Claude Code to version 2.1.179 or later. If upgrading immediately is not possible, do not install third-party plugins or use untrusted plugin repositories.
$ npm install -g @anthropic-ai/claude-code@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.