---
id: CVE-2026-86063
title: Claude Code is an agentic coding tool
summary: >-
  Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and
  Claude Desktop plugin installation flow runs git checkout for a
  marketplace-pinned commit without verifying that the resulting HEAD equals the
  pinned 40-charact…
severity: high
cwe:
  - CWE-494
  - CWE-829
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:19:36.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86063'
references:
  - url: 'https://github.com/anthropics/claude-code/releases/tag/v2.1.179'
    label: security-advisories@github.com
  - url: >-
      https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86063.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-86063'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2551595'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-86063'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86063'
  - url: 'https://github.com/advisories/GHSA-pq7j-f95f-qfcv'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - ghsa
  - npm
ingestedAt: '2026-10-13T19:43:29.199Z'
vendor: Red Hat
product: Red Hat OpenShift Dev Spaces
affected:
  - openshift_dev_spaces
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: vendor
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-13T20:14:06.546364Z'
scores:
  vendor: 8.8
  cna: 7.5
aliases:
  - GHSA-pq7j-f95f-qfcv
ecosystem: npm
patched:
  - '@anthropic-ai/claude-code 2.1.179'
epss: 0.00172
epssPercentile: 0.06513
---

## Overview

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86063.json)

## Package advisory (CVE-2026-86063)

Affected packages:

- `@anthropic-ai/claude-code < 2.1.179`

Patched in:

- `@anthropic-ai/claude-code 2.1.179`

Source: https://github.com/advisories/GHSA-pq7j-f95f-qfcv