Is Claude Code patched against CVE-2026-86063?

Claude Code 2.1.179 adds the missing verification, per Anthropic's advisory, which confirms that auto-update users already have the fix. Installations below 2.1.179 still accept a branch named like the pinned commit. Teams that mirror or vendor the @anthropic-ai/claude-code package should bump it explicitly rather than wait for an automatic upgrade.

Does CVE-2026-86063 affect plugins from a marketplace I trust?

Exploitation needs the plugin's upstream repository under attacker control, so a marketplace entry pointing at a repository you trust is not directly at risk. Anthropic's listed conditions include installing a malicious plugin and pinning it to a safe hash. Treat a commit pin as a review aid rather than a security boundary on versions before 2.1.179.

How does the SHA pin bypass compare to Plugin4Shell?

Plugin4Shell, disclosed by AIR Security on September 17, 2026, was a zero-click remote code execution chain across four coding agents. CVE-2026-86063 is narrower: a missing integrity check that lets attacker-controlled code pass a pinned-commit review in Claude Code and Claude Desktop. Both were reported by AIR Security researchers, and both concern how agents install third-party plugins.

MEDVulnerability Supply chain

Claude Code: a branch named like a commit defeated plugin SHA pinning

Pinning a Claude Code plugin to a reviewed commit did not guarantee that the reviewed commit was the code installed.

October 9, 2026 · Anthropic · Research by Or Nevo Michrowski (AIR Security)

CVE-2026-86063

MEDVulnerability

CVE-2026-86063 let an attacker who controls a plugin repository bypass Claude Code's commit SHA pin by creating a branch named after the pinned hash. Anthropic fixed the check in 2.1.179.

01What happened

Anthropic published GHSA-pq7j-f95f-qfcv on October 9, 2026 with CVE-2026-86063, a plugin integrity flaw in Claude Code and Claude Desktop. Or Nevo Michrowski of AIR Security reported it. Version 2.1.179 of the @anthropic-ai/claude-code npm package carries the fix.

02How it works

The plugin install flow ran git checkout against a marketplace's pinned 40-character commit SHA, then never checked that the resulting HEAD matched that SHA. An attacker controlling the plugin's upstream repository could create a branch whose name is exactly the pinned SHA, and git resolved the checkout to that branch tip instead of to the commit. The reviewed code was silently replaced by the attacker's, bypassing the pinned hash.

03Who is affected

Claude Code and Claude Desktop installations on @anthropic-ai/claude-code below 2.1.179. Anthropic lists three conditions for exploitation, set out below, including a plugin source hosted on a git host that permits branch names shaped like a SHA.

04What to do

Update to Claude Code 2.1.179 or later; auto-update installations already have it. Re-check any plugin installed from a repository you do not control, because a pinned hash alone did not prove which code ran.

Questions people ask

Is Claude Code patched against CVE-2026-86063?: Claude Code 2.1.179 adds the missing verification, per Anthropic's advisory, which confirms that auto-update users already have the fix. Installations below 2.1.179 still accept a branch named like the pinned commit. Teams that mirror or vendor the @anthropic-ai/claude-code package should bump it explicitly rather than wait for an automatic upgrade.
Does CVE-2026-86063 affect plugins from a marketplace I trust?: Exploitation needs the plugin's upstream repository under attacker control, so a marketplace entry pointing at a repository you trust is not directly at risk. Anthropic's listed conditions include installing a malicious plugin and pinning it to a safe hash. Treat a commit pin as a review aid rather than a security boundary on versions before 2.1.179.
How does the SHA pin bypass compare to Plugin4Shell?: Plugin4Shell, disclosed by AIR Security on September 17, 2026, was a zero-click remote code execution chain across four coding agents. CVE-2026-86063 is narrower: a missing integrity check that lets attacker-controlled code pass a pinned-commit review in Claude Code and Claude Desktop. Both were reported by AIR Security researchers, and both concern how agents install third-party plugins.

Sources 2 links, all fetched

1github.comAnthropic Advisory
2github.comAll Anthropic Advisories