2026-10-15 · 2026-Q4
Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)
Was this approved as what it claims to be?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Claude Code before 2.1.179 and Claude Desktop plugin installs
Impact
The plugin install flow ran `git checkout` on a marketplace's pinned commit SHA without confirming HEAD matched it. An attacker controlling a plugin's upstream repository could create a branch named with the same 40-character SHA, so the checkout resolved to the attacker's branch tip and installed unreviewed code despite the pin. Requires a git host that allows SHA-shaped branch names. CVSS 7.5. Reported by Air Security
Root cause
Git resolves an ambiguous ref name before a commit hash, and the installer trusted the checkout result instead of verifying the resulting commit
CVE
Sources
Catalog
Cite this: AgentProv incident record: Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063) (2026-10-15). https://agentprov.com/incidents/2026-10-15-claude-code-plugin-hash-pins-could-be-bypassed-with-a-branch-named-like-the
Related
- Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
- Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
- Also L7 · 2026-10-08Shai-Hulud Variant Compromises the Tensorlake npm SDK for AI Agent Sandboxes and Wipes Home Directories if Its Token Is RevokedL7Build / Approval