Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-86063 · Microsoft / collected KEV context

EUVD-2026-100461

GHSA-pq7j-f95f-qfcv

cve-program · CVE-2026-86063

• https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
• https://github.com/anthropics/claude-code/releases/tag/v2.1.179

euvd · EUVD-2026-100461

• https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
• https://github.com/anthropics/claude-code/releases/tag/v2.1.179

nvd · CVE-2026-86063

• https://github.com/anthropics/claude-code/releases/tag/v2.1.179
• https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv

osv · GHSA-pq7j-f95f-qfcv

• https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-86063
• https://github.com/anthropics/claude-code
• https://github.com/anthropics/claude-code/releases/tag/v2.1.179

• Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character … · Advisory content revised · 1 Nov 2026