CVE-2026-86063: 
Claude Code vulnerability analysis and mitigation

CVE-2026-86063 is a plugin commit SHA pin bypass vulnerability in Anthropic's Claude Code (and Claude Desktop) agentic coding tool that allows an attacker controlling a plugin repository to execute arbitrary code on a victim's system. Prior to version 2.1.179, the plugin installation flow performed a git checkout of a marketplace-pinned commit SHA without verifying that the resulting HEAD matched the pinned 40-character SHA. The vulnerability affects all versions of @anthropic-ai/claude-code before 2.1.179 and was disclosed on October 9, 2026, with NVD publication on October 13, 2026. It carries a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Github Advisory DB).

The root cause is a missing integrity verification step after git checkout during plugin installation, classified as CWE-494 (Download of Code Without Integrity Check) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Git's checkout command, when given a 40-character string, will resolve to a branch of that name before falling back to a commit object — meaning an attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names (e.g., a branch named a1b2c3d4... matching the pinned SHA) can cause the checkout to silently resolve to the attacker's branch tip rather than the reviewed commit. Exploitation requires three conditions: the attacker controls the plugin's upstream repository, the hosting Git platform allows branch names that are 40-character hex strings, and a user installs the plugin while pinning it to the ostensibly safe hash (GitHub Advisory, Github Advisory DB).

Successful exploitation results in arbitrary code execution with the privileges of the Claude Code process on the victim's machine, giving the attacker full control over confidentiality, integrity, and availability of the vulnerable system. An attacker could exfiltrate sensitive data accessible to the Claude Code process (e.g., source code, credentials, API keys), modify files, or disrupt availability. Because Claude Code is an agentic tool with broad filesystem and shell access by design, the blast radius of a compromised plugin is particularly significant (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory DB). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.171% (6th percentile), indicating a low near-term exploitation probability. The attack requires user interaction (a victim must install the malicious plugin) and specific hosting conditions (a Git platform permitting SHA-shaped branch names), which limits opportunistic exploitation (Github Advisory DB).

1. Identify a target plugin: The attacker identifies a Claude Code marketplace plugin they control or can compromise, hosted on a Git platform that permits 40-character hexadecimal branch names (e.g., certain self-hosted or permissive Git services).
2. Obtain the pinned SHA: The attacker determines the specific 40-character commit SHA that the Claude Code marketplace has pinned for the plugin (this is typically visible in the marketplace metadata or plugin configuration).
3. Create a malicious branch: In the plugin repository, the attacker creates a new branch named exactly after the pinned 40-character SHA (e.g., git checkout -b a1b2c3d4e5f6... with the full 40-char hex string) and pushes attacker-controlled malicious plugin code to the tip of this branch.
4. Wait for user installation: The attacker waits for a victim user to install the plugin via Claude Code or Claude Desktop, pinning it to the ostensibly reviewed and safe commit hash.
5. SHA resolution bypass: During installation, Claude Code runs git checkout <pinned-SHA>. Git resolves the argument as a branch name (the attacker's branch) rather than a commit object, silently checking out the attacker's branch tip.
6. Code execution: The attacker-controlled plugin code is installed and subsequently executed with the full privileges of the Claude Code process, enabling data exfiltration, persistence, or further lateral movement (GitHub Advisory, Github Advisory DB).

• File System: Unexpected or recently modified plugin files in the Claude Code plugin installation directory that do not match the expected reviewed commit content; plugin files with timestamps inconsistent with the pinned commit date.
• Logs: Claude Code installation logs showing a git checkout of a 40-character SHA that resolves to a branch rather than a detached HEAD at the expected commit; discrepancies between the checked-out HEAD SHA and the marketplace-pinned SHA in installation logs.
• Network: Outbound network connections from the Claude Code process to unexpected external hosts shortly after plugin installation, potentially indicating data exfiltration or C2 communication initiated by malicious plugin code.
• Process: Unusual child processes spawned by the Claude Code process following plugin installation (e.g., shell commands, scripting interpreters, or network utilities not typical of normal plugin operation) (GitHub Advisory).

Anthropic has released a fix in Claude Code version 2.1.179, which verifies that the HEAD resulting from git checkout matches the marketplace-pinned 40-character SHA before completing plugin installation. Users on standard Claude Code auto-update have already received this fix; users performing manual updates should upgrade to version 2.1.179 or later immediately. As an interim measure, users should only install plugins from trusted and verified repositories and avoid installing plugins from repositories hosted on platforms known to permit SHA-shaped branch names (GitHub Advisory, Claude Code Release).

The vulnerability was reported by Or Nevo Michrowski of Air Security and credited in the official GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it high priority and severity (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been identified at this time.