Claude Code plugin install flow bypasses pinned-SHA verification

What's on the official record

The OSV advisory GHSA-pq7j-f95f-qfcv, dated 15 October 2026, reports a HIGH-severity vulnerability in the npm package @anthropic-ai/claude-code, in the coding_agent layer. It aliases the issue as CVE-2026-86063, with CWE-494 and CWE-829. The advisory names no affected-version range and states the fix is in version 2.1.179. The record states that the plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA.

Assessment

For a platform or AI-stack owner, the record lets you check that deployed Claude Code or Claude Desktop instances are at version 2.1.179 or later, the version the advisory names as the fix. It also lets you check whether your plugin install flow verifies that a checkout's HEAD matches the pinned commit SHA. You can decide to pull the fixed version where the record shows the flow does not verify the checkout against the pinned SHA.

For a deal team, the record lets you scope diligence on whether a target's deployed Claude Code or Claude Desktop stack runs a version below 2.1.179. The advisory names no affected-version range, so version inventory is the concrete check this record supports. You can decide whether the missing affected-version range is a price or condition item.

What would change this call

A corroborating advisory from the vendor or a NVD entry naming an affected-version range would move this past a single open-source record.

What to check next

Confidence

Filed 25 October 2026 from the record dated 15 October 2026. The note rests on a single open-source advisory with no independent corroboration in this record.

Sources

[1] Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning — https://github.com/advisories/GHSA-pq7j-f95f-qfcv