Claude Code and Claude Desktop CVE-2026-86063

Vulnerability

Published 2026-10-09

Verified 2026-10-14

Claude Code and Claude Desktop CVE-2026-86063 (CVSS 4.0 7.5): plugin installs pinned to a reviewed commit could pull attacker code instead, via a branch named after that commit's SHA; fixed in Claude Code 2.1.179

Anthropic published a GitHub security advisory (GHSA-pq7j-f95f-qfcv) on 9 October 2026, and the CVE record CVE-2026-86063 followed on 13 October. The plugin installation flow in Claude Code and Claude Desktop ran git checkout on the 40-character commit SHA that a marketplace had pinned, but never checked that the resulting HEAD actually matched that SHA. Someone controlling a plugin's upstream repository on a Git host that allows branch names shaped like SHAs could create a branch named after the reviewed commit; checkout would then pick the branch tip, so the attacker's code was installed while the pin appeared to be honoured. Exploitation needs a user to install the malicious plugin pinned to the supposedly safe hash. Anthropic rates it CVSS 4.0 7.5 (high) and fixed it in Claude Code 2.1.179. It says users on standard auto-update already have the fix and those who update by hand should move to the latest version. Or Nevo Michrowski of Air Security reported the issue. No exploitation is reported. Primary: Anthropic's GitHub security advisory.

Product

Anthropic Claude Code and Claude Desktop (plugin installation flow)

Versions

Claude Code before 2.1.179 (and the Claude Desktop plugin install flow). Fixed: Claude Code 2.1.179.

CVSS

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

AVAttack Vector: Network
ACAttack Complexity: Low
ATAttack Requirements: Present
PRPrivileges Required: None
UIUser Interaction: Active
VCVulnerable System Confidentiality: High
VIVulnerable System Integrity: High
VAVulnerable System Availability: High
SCSubsequent System Confidentiality: None
SISubsequent System Integrity: None
SASubsequent System Availability: None

(CVSS 4.0, Anthropic)

Exploited in Australia?

unknown

Patch to

Make sure Claude Code is on 2.1.179 or later (auto-update should already have applied it; run a manual update if auto-update is off) and keep Claude Desktop current. Review plugins installed from third-party marketplaces before the fix, and treat a pinned commit as trustworthy only when the tool verifies the checked-out HEAD.

Primary: Anthropic (GitHub advisory GHSA-pq7j-f95f-qfcv) — Plugin commit SHA pin bypass allows installation of attacker-controlled code (9 Oct 2026) · Vendor: Anthropic — Claude Code v2.1.179 release · CVE: CVE-2026-86063 · CVE record — CVE-2026-86063 (published 13 Oct 2026)

tech ai