What happened
Published 2026-10-13 (CVSS 7.5 v4.0, CWE-494/829) via GitHub advisory. The plugin-install flow did not confirm the checkout result matched the pinned commit, enabling a git branch named after the pinned SHA to be substituted. Verified via NVD REST API; fix in release 2.1.179.
Why it matters
Claude Code plugins run inside the agent's coding session with the developer's credentials. A SHA-pin bypass turns the 'reviewed, pinned hash' trust anchor into a forgery path, so even rigorously-pinned plugin installs can silently install attacker code — directly undermining the supply-chain trust model of agentic coding tooling.
Attack vector
An attacker who controls a plugin repository creates a branch literally named after the 40-char SHA that a user pins. The install flow runs git checkout for the marketplace-pinned commit without verifying the resulting HEAD equals the pinned SHA, so checkout resolves to the branch tip and installs attacker-controlled plugin code in the agent environment.
Affected systems
Anthropic Claude Code and Claude Desktop < 2.1.179 (plugin marketplace installation flow)
Mitigation
Upgrade Claude Code to 2.1.179 (plugin install flow now verifies the resolved HEAD against the pinned SHA). See GHSA-pq7j-f95f-qfcv.