CVE-2026-86063— Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Quick assessment
Affected
anthropics claude-code
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Claude Code 是一款智能体编码工具。在版本 2.1.179 之前，Claude Code 和 Claude Desktop 插件的安装流程会使用 命令切换至市场锁定的提交（marketplace-pinned commit），但并未验证最终 HEAD 是否等于该锁定的 40 字符 SHA 值。如果攻击者控制了一个 Git 主机上支持以 SHA 命名分支的插件仓库，他们可以创建一个名为已审查提交 SHA 的分支，从而使 操作选择该分支的尖端（tip）并安装由攻击者控制的插件代码。利用此漏洞需要用户安装恶意插
Possible ATT&CK Techniques 1 AI
T1587.001 · MalwareAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| anthropics | claude-code | < 2.1.179 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86063
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Source: CVE Program / CVE List V5
Vulnerability Description
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
下载代码缺少完整性检查
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| anthropics | claude-code | < 2.1.179 | - |
|
II. Public POCs for CVE-2026-86063
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86063
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86063 (1)
Vendor Pages for CVE-2026-86063 (1)
-
🔗 Release v2.1.179 · anthropics/claude-code · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: claude-code
-
CVE-2026-55607
Claude Code: Sandbox Escape via Git Worktree Path Confusion -
CVE-2026-46406
Claude Code: Insecure Temporary File in /copy Command Enable -
CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved -
CVE-2026-44470
Claude Desktop: Local Privilege Escalation via Directory Jun -
CVE-2026-44467
Claude Desktop: SSH Host Key Verification Bypass Allows Man-
Same vendor: anthropics
-
CVE-2026-47751
Claude Code Action: Malicious MCP Server Configuration in PR -
CVE-2026-55407
Buffa: Memory Exhaustion Denial of Service in decode_unknown -
CVE-2026-55406
Buffa: Use-After-Free in OwnedView via Unsound 'static Lifet -
CVE-2026-55607
Claude Code: Sandbox Escape via Git Worktree Path Confusion -
CVE-2026-46406
Claude Code: Insecure Temporary File in /copy Command Enable
Same weakness: CWE-494
-
CVE-2026-110102
powerlevel10k through 1.20.0 Download of Code Without Integr -
CVE-2026-108160
AstronRPA through 1.1.6 Unsigned Update Installation via Pla -
CVE-2026-107812
Nginx UI: Self-upgrade runs an unsigned binary verified only -
CVE-2026-29797
Red Lion Controls N-Tron 700 Series Download of Code Without -
CVE-2026-105295
GitAhead 2.5.0 through 2.7.1 Unverified Update Installation
V. Comments for CVE-2026-86063
No comments yet