Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-86063

CVE-2026-86063: Claude Code Git Checkout RCE Vulnerability

CVE-2026-86063 is a remote code execution vulnerability in Claude Code that exploits git checkout during plugin installation, allowing attackers to inject malicious code. This article covers technical details, affected versions, and mitigation.

Published:

CVE-2026-86063 Overview

CVE-2026-86063 affects Anthropic's Claude Code and Claude Desktop plugin installation flow. The vulnerability allows an attacker who controls a plugin repository to bypass commit SHA pinning and install arbitrary code. The flaw stems from git checkout operations that do not verify the resulting HEAD matches the pinned 40-character SHA. On Git hosts that permit SHA-shaped branch names, attackers can create a branch named identically to a reviewed commit, redirecting checkout to the attacker-controlled branch tip. This issue is classified as download of code without integrity check [CWE-494] and is fixed in version 2.1.179.

Critical Impact

Successful exploitation installs attacker-controlled plugin code into developer environments, enabling arbitrary code execution within the context of the Claude Code or Claude Desktop user.

Affected Products

  • Anthropic Claude Code prior to version 2.1.179
  • Anthropic Claude Desktop plugin installation flow prior to 2.1.179
  • Marketplace-pinned plugins hosted on Git providers that allow SHA-shaped branch names

Discovery Timeline

  • 2026-10-13 - CVE-2026-86063 published to NVD
  • 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-86063

Vulnerability Analysis

The Claude Code plugin system allows users to install plugins pinned to a specific commit SHA for integrity assurance. The installation flow invokes git checkout with the pinned commit identifier but never confirms that HEAD resolves to the expected 40-character hash. Git resolves ambiguous references by preferring branch names over commit SHAs when both exist. An attacker who controls the plugin repository creates a branch whose name matches the reviewed commit SHA, causing checkout to land on the attacker-controlled branch tip instead of the audited commit.

Root Cause

The root cause is a missing post-checkout integrity validation step. The installer trusts Git's reference resolution without comparing the resolved commit object against the user-supplied SHA. This maps to [CWE-494] Download of Code Without Integrity Check. The fix in 2.1.179 adds verification that the checked-out HEAD matches the pinned SHA before loading plugin code.

Attack Vector

Exploitation requires user interaction. A victim must install the malicious plugin and pin it to a commit SHA that the attacker has previously made available for review. The attacker then pushes a branch to the plugin repository whose name mirrors the reviewed SHA. When the user installs or updates the plugin, git checkout <sha> resolves to the branch tip, executing attacker-controlled code within the plugin runtime context.

No synthetic exploitation code is reproduced here. Refer to the GitHub Security Advisory GHSA-pq7j-f95f-qfcv for authoritative technical detail.

Detection Methods for CVE-2026-86063

Indicators of Compromise

  • Plugin repositories that contain branches whose names are 40-character hexadecimal strings matching commit SHAs.
  • Unexpected plugin code changes following installation or update operations against versions prior to 2.1.179.
  • Local plugin directories where git rev-parse HEAD returns a commit object different from the SHA recorded in marketplace metadata.

Detection Strategies

  • Audit installed Claude Code and Claude Desktop plugins by comparing the actual HEAD commit of each plugin working tree against the pinned SHA in marketplace manifests.
  • Enumerate remote references on third-party plugin repositories and flag any branch names that match 40-character hex patterns.
  • Monitor developer endpoints for process execution of plugin code originating from Claude Code directories after installation events on vulnerable versions.

Monitoring Recommendations

  • Log and review all plugin installation and update events emitted by Claude Code builds prior to 2.1.179.
  • Enable endpoint telemetry on developer workstations to capture child processes spawned by Claude Code and Claude Desktop plugin runtimes.
  • Correlate Git clone and checkout operations targeting plugin marketplaces with subsequent file writes and script executions.

How to Mitigate CVE-2026-86063

Immediate Actions Required

  • Upgrade Claude Code and Claude Desktop to version 2.1.179 or later.
  • Inventory existing plugins and verify that each plugin's installed HEAD commit matches the pinned SHA in the marketplace manifest.
  • Remove or reinstall any plugin whose checked-out commit cannot be verified against its pinned SHA.

Patch Information

Anthropic released the fix in Claude Code 2.1.179. The updated installer verifies that the resolved HEAD equals the pinned 40-character SHA before loading plugin code. Full release details are available in the GitHub Release Note v2.1.179 and the GitHub Security Advisory GHSA-pq7j-f95f-qfcv.

Workarounds

  • Restrict plugin installations to repositories hosted on providers that disallow SHA-shaped branch names until upgrading.
  • Avoid installing third-party plugins from untrusted or unaudited repositories.
  • Manually verify the plugin working tree with git rev-parse HEAD after installation and compare the output to the expected SHA.

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne