Supply Chain Vulnerability in Claude Code by Anthropic
CVE-2026-86063

7.5HIGH

Key Information:

Vendor

Anthropics

Status
Claude-code
Vendor
CVE Published:
13 October 2026

What is CVE-2026-86063?

The Claude Code tool has a supply chain vulnerability that affects its plugin installation mechanism. Prior to version 2.1.179, the installation process did not verify the integrity of the committed code, allowing an attacker with control over a plugin repository to craft a malicious branch. This vulnerability allows unauthorized code execution if a user unknowingly installs a compromised plugin, pinning it to a SHA hash that appears safe. Updates to version 2.1.179 are crucial for mitigating this risk.

Affected Version(s)

claude-code < 2.1.179

References

https://github.com/anthropics/claude-code/security/adviso...
x_refsource_CONFIRM
https://github.com/anthropics/claude-code/releases/tag/v2...
x_refsource_MISC

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.