HighGHSA-pq7j-f95f-qfcvCVE-2026-860639 Oct · 14 days ago
Source ↗

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning.

Does it affect you?

Not read yet

Conditions are read within the hour after an advisory comes in.

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin so

SourcesGitHub advisoryGitHub advisory database

Timeline

9 Oct
14 daysfrom publication to Patchwire
  1. Published by GitHub advisory9 Oct
  2. Seen by Patchwire23 Oct
  3. Fix released9 Oct
@anthropic-ai/claude-code2.1.179

Versions of @anthropic-ai/claude-code

2.x
safe 2.1.179
AffectedSafe

Packages

@anthropic-ai/claude-code

Stacks

Claude Code

Related alerts(2)

Same packages

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

@anthropic-ai/claude-code · 5 Oct

High
Conditions not read yet

Source summary

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lowe

Affected
@anthropic-ai/claude-code <2.1.129
Fixed in
2.1.129
ID
GHSA-5j29-h97v-84ch
Open the alert

Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In

@anthropic-ai/claude-code · 29 Sep

Low
Conditions not read yet

Source summary

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying t

Affected
@anthropic-ai/claude-code >=2.0.68 <2.1.260
Fixed in
2.1.260
ID
GHSA-gfvf-j8jh-jxxw
Open the alert