CVE-2026-86063

CVE-2026-86063 · Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

CVSS 7.5 · Высокий · EPSS 0,2% · Есть исправление

Опубликовано

2026-10-13T19:04:11.695Z

Обновлено

2026-10-13T20:21:00.156Z

Стек: node

Проверьте свой сервер →