CVE-2026-86063: Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow…

Summary

Prior to version 2.1.179, the Claude Code and Claude Desktop plugin installation flow ran git checkout for a marketplace-pinned commit without checking that the resulting HEAD matched the pinned 40-character SHA. An attacker controlling a plugin repository on a Git host that allows SHA-shaped branch names could create a branch named after the reviewed commit, so checkout selected the branch tip and installed attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the apparently safe hash.

Mitigation

Fixed in version 2.1.179.

Topics

• AI agents

Related items

• MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
• HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSame vendor · NVD/CVE Database
• HighCVE-2026-103435: Claude Code symlink race condition allows writes outside project directorySame vendor · NVD/CVE Database
• HighGHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverSame vendor · GitHub Advisory Database
• HighCVE-2026-103012: Claude Code stored API key overrides organization policy sign-inSame vendor · NVD/CVE Database