Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)

Claude Code before 2.1.179 and Claude Desktop plugin installs

The plugin install flow ran `git checkout` on a marketplace's pinned commit SHA without confirming HEAD matched it. An attacker controlling a plugin's upstream repository could create a branch named with the same 40-character SHA, so the checkout resolved to the attacker's branch tip and installed unreviewed code despite the pin. Requires a git host that allows SHA-shaped branch names. CVSS 7.5. Reported by Air Security

Git resolves an ambiguous ref name before a commit hash, and the installer trusted the checkout result instead of verifying the resulting commit