CVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.
What it is
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
How to check
- Affected: @anthropic-ai/claude-code (npm) < 2.1.179.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @anthropic-ai/claude-code to 2.1.179 or later.
npm ls @anthropic-ai/claude-code -g # or: claude --versionSources
- highCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
- highCVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
- highCVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
- highCVE-2026-33068: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File