Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.179. It is, therefore, affected by a   hash pinning bypass vulnerability:

  - The plugin install flow in Claude Code checked out a marketplace's pinned commit SHA using git     checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling     a plugin's upstream repository could create a branch named identically to the pinned 40-character     SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed     commit, resulting in attacker-controlled code being installed and bypassing the pinned hash.
    Exploitation required a user to install a malicious plugin, pin it to a safe hash, and for the plugin     source to be hosted on a git host that permitted SHA-shaped branch names. (CVE-2026-86063)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin
    installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting
    HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that
    permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to
    select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install
    the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
    (CVE-2026-86063)

ID	Name	Product	Family	Type	Severity
370432	Anthropic Claude Code < 2.1.179 Plugin Hash Pinning Bypass (CVE-2026-86063)	Nessus	Misc.	Local	high
474675	SCA: security update for @anthropic-ai/claude-code (GHSA-pq7j-f95f-qfcv)	Tenable Cloud Security	SCA Checks	Local	high
474675	SCA: security update for @anthropic-ai/claude-code (GHSA-pq7j-f95f-qfcv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-86063

high

Tenable Plugins

high

high

high