# CVE-2026-86063: Anthropic Claude Code plugin hash pin bypass in git checkout

Source: https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-86063 · Severity: high · CVSS 4 · Published 2026-10-15

Claude Code and Claude Desktop are AI coding assistants that install plugins from package marketplaces. A vulnerability in the plugin installation process allows an attacker controlling a plugin's source repository to bypass security verification and install malicious code by creating a branch with a name matching a supposedly-secure commit hash, causing the application to run attacker-controlled code instead of the reviewed version.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [Anthropic Claude Desktop](https://junglewise.ai/threats/technologies/claude-desktop), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-86063 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86063 being exploited in the wild.

**How severe is CVE-2026-86063?** High severity, with a CVSS score of 4, published 15 October 2026.

**Which products and versions are affected?** Anthropic Claude Code < 2.1.179; Anthropic Claude Desktop < 2.1.179; @anthropic-ai/claude-code (npm) < 2.1.179, SEMVER:introduced=0,fixed=2.1.179.

**Is there a fix for CVE-2026-86063?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.179 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86063 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86063?** Check whether you run Anthropic Claude Code, Anthropic Claude Desktop or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.1.179 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.1.179
  ```


## Technical details

The plugin installer uses `git checkout` to fetch a pinned commit SHA but fails to verify that the resulting HEAD matches the intended hash. An attacker can create a branch whose name is a valid 40-character SHA, causing git to resolve the checkout to the attacker's branch tip rather than the pinned commit. This requires the user to install a malicious plugin and for the hosting platform to allow SHA-shaped branch names; the verification bypass enables code execution with user privileges.

## Affected products

- Anthropic Claude Code < 2.1.179
- Anthropic Claude Desktop < 2.1.179

## Identifiers

- CVE-2026-86063
- GHSA-pq7j-f95f-qfcv

## Timeline

- 2026-10-09: disclosed
- 2026-10-15: advisory

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv](https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Desktop arbitrary code execution via uncontrolled search path](https://junglewise.ai/threats/cve-2026-88066-claude-desktop-is-anthropic-s-desktop-application-for-interacting)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)