On October 15, 2026, GitHub published advisory GHSA-pq7j-f95f-qfcv, CVE-2026-86063, for the plugin install flow in Claude Code and Claude Desktop. It is rated high, 7.5 under CVSS 4.0, and affects Claude Code before version 2.1.179.
Plugin marketplaces can pin a plugin to a specific 40-character commit SHA, so that users install the exact code that was reviewed. The installer fetched that pin with git checkout but never verified that the resulting HEAD actually matched the SHA. Git resolves a name to a branch before treating it as a raw commit ID, so an attacker who controlled a plugin’s upstream repository could create a branch whose name was identical to the pinned SHA. The checkout then silently landed on the attacker’s branch tip, and attacker-controlled code was installed while the pin appeared to hold. Anthropic credits Or Nevo Michrowski of Air Security, and says users on standard auto-update already have the fix.
Why it matters: pinning to a commit hash is the standard defence against a plugin author, or a hijacked repository, swapping code after review. This bug shows how easily that guarantee breaks when a tool trusts git’s name resolution instead of checking the result, at a moment when coding-agent plugin ecosystems are growing quickly and plugins run with the agent’s full permissions.
What it does not show: exploitation needs a user to install a malicious plugin, pin it to a safe hash, and have the plugin hosted on a git service that permits SHA-shaped branch names. No exploitation has been reported.