CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Attackers can bypass hash pinning in Claude Code by creating branches named after commit SHAs, leading to installation of malicious plugin code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-86063?
CVE-2026-86063 is a high-severity vulnerability in anthropics claude-code, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
Which versions are affected by CVE-2026-86063?
2 open source packages ship an affected version, including @anthropic-ai/claude-code.
| Package | Affected | Fixed in |
|---|---|---|
@anthropic-ai/claude-code npm | All versions | 2.1.179 |
@anthropic-ai/claude-code npm | All versions | 2.1.179 |
How do I fix CVE-2026-86063?
Upgrade @anthropic-ai/claude-code to 2.1.179 or later.
Is CVE-2026-86063 being exploited?
There is no known exploitation of CVE-2026-86063 in the wild and no public exploit code.
Sources
Also known as GHSA-pq7j-f95f-qfcv, MINI-r3r8-hmgf-fmm4.