Read the docs
TI-2026-72849 Aliases CVE-2026-86063GHSA-pq7j-f95f-qfcv

Hash pin bypass in Claude Code plugin installation

Priority LOW 34CWE-494Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-494.

Summary

Claude Code before 2.1.179 installs plugins without checking that the checked-out commit matches the marketplace-pinned hash, which is missing integrity verification of downloaded code (CWE-494). An attacker who controls a plugin repository on a Git host that accepts SHA-shaped branch names can create a branch named after the reviewed commit, so checkout installs the attacker's plugin code. Exploitation requires a user to install the malicious plugin and pin it to the apparently safe hash.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed claude-code (anthropics): 2.1.179@anthropic-ai/claude-code (npm): 2.1.179Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anthropicsclaude-codebefore 2.1.1792.1.179Patch availableCNA
—@anthropic-ai/claude-code (npm)before 2.1.1792.1.179Patch availableGHSA-pq7j-f95f-qfcv
  • claude-code Vendoranthropics Affected before 2.1.179 Fixed in 2.1.179 Patch available CNA
  • @anthropic-ai/claude-code (npm) Vendor— Affected before 2.1.179 Fixed in 2.1.179 Patch available GHSA-pq7j-f95f-qfcv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:*:*:*——anthropics
  • cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:*:*:* Versions — — ·anthropics

Remediation

Update the npm package @anthropic-ai/claude-code to version 2.1.179, which is the fixed version. The sources list no fixed version for claude-code. Red Hat OpenShift Dev Spaces 3.31 is fixed by RHSA-2026:90321, released 2026-10-26.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA claude-code (anthropics) Fixed in 2.1.179
  • Fix · GHSA-pq7j-f95f-qfcv @anthropic-ai/claude-code (npm) Fixed in 2.1.179 Advisory →

Red Hat 1 advisory

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 1 product
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-86063
  2. 2026-10-16 Alias added: GHSA-pq7j-f95f-qfcv
  3. 2026-10-16 Fix available: npm/@anthropic-ai/[email protected] · GHSA-pq7j-f95f-qfcv
  4. 2026-10-16 CVSS score added · GHSA-pq7j-f95f-qfcv
  5. 2026-10-16 Weakness changed · GHSA-pq7j-f95f-qfcv
  6. 2026-10-16 4 new references · GHSA-pq7j-f95f-qfcv
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-16 CVSS score added · Red Hat
  9. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  10. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 1

Other 3

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
  • TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
  • TI-2025-24240 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling CVSS 4.0CRITICAL 9.3
  • TI-2025-32918 Claude Code IDE extensions allow websocket connections from arbitrary origins CVSS 4.0HIGH 8.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences