The Claude Code plugin installer could display a pinned Git commit while loading different bytes. The affected checkout flow passed a 40-character hexadecimal pin to git checkout, then trusted successful completion rather than independently comparing the resolved HEAD with the requested immutable object. On a Git host that allows branch names resembling a…
Case · DiggingBeagle record
Claude Code plugin pin bypass through SHA-shaped Git branch
A marketplace plugin checkout could resolve a 40-character pinned commit string as an attacker-controlled branch instead of enforcing that exact Git commit.
Scope
CVE-2026-86063 / GHSA-pq7j-f95f-qfcv; Claude Code plugin installation before 2.1.179; malicious upstream and SHA-shaped branch preconditions.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
A reviewed GitHub security advisory identifies CVE-2026-86063, the commit-versus-reference ambiguity and the fixed version 2.1.179. The report supports a conditional supply-chain route, not automatic code execution for every Claude Code user or in-the-wild adoption of a malicious branch. Deployment scale and harm are unknown.
Assessed Oct 18, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP13-PIN-FIX · CLM-CP13-PIN-ROOT · CLM-ENRICH-PIN-NOVICTIM · GHSA-pq7j-f95f-qfcv: Claude Code pinned-SHA plugin checkout bypass
At a glance
A marketplace pin is an integrity claim only if the resolved installed object matches it. A pin string displayed to the operator, or a successful checkout exit code, does not attest the bytes actually loaded. This differs from the Claude Agent SDK resume issue, where a startup argument is interpreted as an option before any plugin integrity check.
Read the implicationsNo confirmed in-the-wild exploitation or number of users who installed a hostile SHA-named branch. Host handling of hex-shaped refs and marketplace installation are necessary attack prerequisites.
Limits and uncertaintyFull account
The Claude Code plugin installer could display a pinned Git commit while loading different bytes. The affected checkout flow passed a 40-character hexadecimal pin to git checkout, then trusted successful completion rather than independently comparing the resolved HEAD with the requested immutable object. On a Git host that allows branch names resembling a commit hash, an attacker controlling the upstream plugin repository could publish a mutable branch with the pin's exact textual name and steer the installation to its tip.
This is not a cryptographic collision against SHA. The attack exploits ambiguity between a ref name and a commit object at the installer boundary. It also requires the adversary to control an upstream plugin repository, the host to permit that branch name, and a user to install the plugin through the affected path. The reviewed advisory identifies versions before 2.1.179 as affected and 2.1.179 as patched with explicit resolved-HEAD verification.
A successful checksum-looking configuration or successful Git command is not proof of provenance unless the installed object is the promised one. The report does not document a widespread deployment of malicious branch-shadowed plugins or a confirmed campaign of compromised users. This failure differs from the Claude Agent SDK resume bug, which lets option-shaped session data influence subprocess launch rather than substituting repository content during installation.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
- 04
Step
Claims & evidence
CLM-CP13-PIN-FIXThe advisory lists Claude Code versions earlier than 2.1.179 as affected and 2.1.179 as patched through explicit resolved HEAD comparison.supported
Basis: reported finding
- supportsGHSA-pq7j-f95f-qfcv: Claude Code pinned-SHA plugin checkout bypassprimary disclosure
GHSA affected versions and patched release
CLM-CP13-PIN-ROOTA 40-hex-character marketplace pin was not independently enforced as the checked-out HEAD, allowing a same-named attacker branch to shadow the target revision on permissive Git hosts.supported
Basis: reported finding
- supportsGHSA-pq7j-f95f-qfcv: Claude Code pinned-SHA plugin checkout bypassprimary disclosure
GHSA technical details, ambiguous Git ref checkout
CLM-ENRICH-PIN-NOVICTIMThe reviewed advisory describes a patch for an attacker-controlled SHA-shaped branch at plugin installation, but does not document a confirmed victim compromise or a cryptographic hash collision.supported
Basis: reported finding
- supportsGHSA-pq7j-f95f-qfcv: Claude Code pinned-SHA plugin checkout bypassprimary disclosure
GitHub reviewed advisory GHSA-pq7j-f95f-qfcv, description, affected and patched releases
Implications
A marketplace pin is an integrity claim only if the resolved installed object matches it. A pin string displayed to the operator, or a successful checkout exit code, does not attest the bytes actually loaded. This differs from the Claude Agent SDK resume issue, where a startup argument is interpreted as an option before any plugin integrity check.
Controls and mitigations
- Update Claude Code to 2.1.179 or later, and enforce equality between the required commit object and the checked-out HEAD before loading an installed plugin.
- Treat a plugin publisher's ability to add branches as a separate trust factor from the immutability of a specifically pinned commit.
Unknowns and contradictions
- No confirmed in-the-wild exploitation or number of users who installed a hostile SHA-named branch.
- Host handling of hex-shaped refs and marketplace installation are necessary attack prerequisites.
Sources and citation
Material revision history
- Oct 18, 2026 · Canonical change recorded · new in release · revision 171