CVE-2026-86063: Claude Code: unverified plugin SHA checkout enables code install

Q: Is CVE-2026-86063 actively exploited?

No confirmed active exploitation of CVE-2026-86063 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86063?

1) Upgrade Claude Code and Claude Desktop to 2.1.179 or later. 2) Inventory installed plugins and their sources across developer endpoints, and re-audit those pulled from third-party Git repositories. 3) For each installed plugin, check that the checked-out HEAD matches the intended 40-character SHA (git rev-parse HEAD) and that no branch shares the SHA's name. 4) Restrict plugin installation to an approved internal marketplace through managed settings. 5) Review plugin hooks, commands and MCP server definitions for unexpected network calls or shell execution. 6) Monitor for unexpected child processes, outbound connections and credential file access from Claude Code processes.

Q: What systems are affected by CVE-2026-86063?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, plugin ecosystems, developer workstations.

Q: What is the CVSS score for CVE-2026-86063?

No CVSS score has been assigned yet.

GHSA-pq7j-f95f-qfcvHIGH

Published October 13, 2026

CISO Take

Claude Code and Claude Desktop's plugin installer runs git checkout for a marketplace-pinned commit but never checks that HEAD actually equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that allows SHA-shaped branch names can create a branch named after the reviewed commit, so the user gets attacker-controlled code even though they pinned what looked like a safe hash. This defeats commit pinning, which security teams treat as a supply chain control. Exploitation still needs a user to install the malicious plugin, and there is no KEV listing, public exploit, scanner template or EPSS data yet. Claude Code is a developer workstation tool with broad file and shell access, so the impact of a successful install is high. Upgrade to Claude Code 2.1.179 or later, and re-review any plugins installed from third-party repositories before that version.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Severity is high. No CVSS vector or EPSS score is available, there is no KEV listing and no public exploit. Exploitation needs user interaction (installing an attacker-controlled plugin) and an attacker-controlled plugin repository, which lowers likelihood. Impact is high because plugins can bundle commands, hooks, agents and MCP servers that run with the developer's privileges. The main risk is false assurance: reviewers believe a pinned SHA guarantees the reviewed code. The package has 22 other CVEs, which points to a recurring flaw pattern in the product.

How does the attack unfold?

Staging

Attacker hosts a plugin repository and creates a branch named after a reviewed, benign commit SHA.

AML.T0104

Initial Access

User installs the plugin pinned to the trusted hash; checkout picks the branch tip without verifying HEAD equals the SHA.

AML.T0010.005

Execution

The attacker-controlled plugin code, hooks or commands run in the Claude Code environment.

AML.T0011.002

Impact

The attacker steals credentials and source code or establishes persistence on the developer workstation.

AML.T0025

Staging

Attacker hosts a plugin repository and creates a branch named after a reviewed, benign commit SHA.

AML.T0104

Initial Access

User installs the plugin pinned to the trusted hash; checkout picks the branch tip without verifying HEAD equals the SHA.

AML.T0010.005

Execution

The attacker-controlled plugin code, hooks or commands run in the Claude Code environment.

AML.T0011.002

Impact

The attacker steals credentials and source code or establishes persistence on the developer workstation.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Claude Code	npm	< 2.1.179	`2.1.179`
153.3KPushed 8d ago61% patched~5d to patchFull package profile →
Claude Code	npm	—	No patch
153.3KPushed 8d ago61% patched~5d to patchFull package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade Claude Code and Claude Desktop to 2.1.179 or later. 2) Inventory installed plugins and their sources across developer endpoints, and re-audit those pulled from third-party Git repositories. 3) For each installed plugin, check that the checked-out HEAD matches the intended 40-character SHA (git rev-parse HEAD) and that no branch shares the SHA's name. 4) Restrict plugin installation to an approved internal marketplace through managed settings. 5) Review plugin hooks, commands and MCP server definitions for unexpected network calls or shell execution. 6) Monitor for unexpected child processes, outbound connections and credential file access from Claude Code processes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionSocial EngineeringAgentPluginFrameworkAML.T0010.005- AI Agent Tool AML.T0011.002- Poisoned AI Agent Tool AML.T0074- Masquerading AML.T0104- Publish Poisoned AI Agent Tool

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies for third-party AI risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-86063?

Is CVE-2026-86063 actively exploited?

No confirmed active exploitation of CVE-2026-86063 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86063?

1) Upgrade Claude Code and Claude Desktop to 2.1.179 or later. 2) Inventory installed plugins and their sources across developer endpoints, and re-audit those pulled from third-party Git repositories. 3) For each installed plugin, check that the checked-out HEAD matches the intended 40-character SHA (git rev-parse HEAD) and that no branch shares the SHA's name. 4) Restrict plugin installation to an approved internal marketplace through managed settings. 5) Review plugin hooks, commands and MCP server definitions for unexpected network calls or shell execution. 6) Monitor for unexpected child processes, outbound connections and credential file access from Claude Code processes.

What systems are affected by CVE-2026-86063?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, plugin ecosystems, developer workstations.

What is the CVSS score for CVE-2026-86063?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsplugin ecosystemsdeveloper workstations

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0011.002Poisoned AI Agent Tool

AML.T0074Masquerading

AML.T0104Publish Poisoned AI Agent Tool

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

Exploitation Scenario

An attacker publishes a useful-looking plugin on a Git host that accepts SHA-shaped branch names. A security reviewer inspects a benign commit and adds its hash to an internal list of approved plugins. The attacker then creates a branch named after that exact hash, pointing at a malicious commit. When a developer installs the plugin pinned to the approved hash, checkout selects the branch tip rather than the reviewed commit. The malicious plugin hooks and commands run on the developer machine and steal tokens, SSH keys and source code, or add a backdoor to the repositories the developer can reach.

Weaknesses (CWE)

CWE-494Download of Code Without Integrity CheckPrimary CWE-829Inclusion of Functionality from Untrusted Control SpherePrimary CWE-494Download of Code Without Integrity Check CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-494 — Download of Code Without Integrity Check: The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

[Implementation] Perform proper forward and reverse DNS lookups to detect DNS spoofing.
[Architecture and Design, Operation] Encrypt the code with a reliable encryption scheme before transmitting. This will only be a partial solution, since it will not detect DNS spoofing and it will not prevent your code from being modified on the hosting site.

Source: MITRE CWE corpus.