Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

影響: npm:@anthropic-ai/claude-code < 2.1.179 → 2.1.179

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash.…

GitHub Advisory Database에서 읽기

2026. 10. 16. 오전 05:22, GitHub Advisory Database에서 "Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js, Anthropic (Claude). CVE: CVE-2026-86063.