{"data":{"id":"25f40c64-de5c-4fda-a8ad-65620ff337e6","title":"CVE-2026-86063: Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow…","summary":"Prior to version 2.1.179, the Claude Code and Claude Desktop plugin installation flow ran git checkout for a marketplace-pinned commit without checking that the resulting HEAD matched the pinned 40-character SHA. An attacker controlling a plugin repository on a Git host that allows SHA-shaped branch names could create a branch named after the reviewed commit, so checkout selected the branch tip and installed attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the apparently safe hash.","solution":"Fixed in version 2.1.179.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86063","publishedAt":"2026-10-13T19:21:21.417Z","cveId":"CVE-2026-86063","cweIds":["CWE-494","CWE-829"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","Claude Desktop"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-14T06:09:04.744Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-14T06:09:08.592Z","patchAvailable":null,"disclosureDate":"2026-10-13T19:21:21.417Z","capecIds":["CAPEC-437"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}