{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "claude-code-plugin-hash-pin-bypass",
  "url": "https://patchgap.ai/incidents/claude-code-plugin-hash-pin-bypass/",
  "path": "/incidents/claude-code-plugin-hash-pin-bypass/",
  "json_url": "https://patchgap.ai/incidents/claude-code-plugin-hash-pin-bypass.json",
  "title": "Claude Code: a bad plugin could sneak in code even when you pinned a safe version. Update to 2.1.179.",
  "category": "ai",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "claude-code"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "GitHub advisory rating: high (NVD score 7.5).",
  "exploited_in_wild": "unknown",
  "exploited_note": "No report that anyone has used this bug.",
  "exploited_source_url": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-13",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-86063"
  ],
  "summary": "Claude Code is an AI helper that works with code. It can add plugins. A plugin author could trick it into installing different code than the safe, locked version you chose. This only works if you install a bad plugin. Anthropic fixed it in version 2.1.179. The normal automatic update has already given the fix to most people.",
  "am_i_affected": "You are at risk if you use Claude Code older than 2.1.179 and install plugins from other people. Run the command below to see your version.",
  "action": "Update Claude Code to 2.1.179",
  "affected": [
   {
    "product": "claude-code",
    "product_name": "Claude Code",
    "platform": "windows",
    "affected_versions": "Claude Code older than 2.1.179",
    "fixed_version": "2.1.179",
    "fixed_min": "2.1.179",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/advisories/GHSA-pq7j-f95f-qfcv",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-86063"
    ],
    "check": {
     "menu_path": "Open a terminal window and type the command below.",
     "command": "claude --version",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://www.anthropic.com/claude-code"
   },
   {
    "product": "claude-code",
    "product_name": "Claude Code",
    "platform": "macos",
    "affected_versions": "Claude Code older than 2.1.179",
    "fixed_version": "2.1.179",
    "fixed_min": "2.1.179",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/advisories/GHSA-pq7j-f95f-qfcv",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-86063"
    ],
    "check": {
     "menu_path": "Open Terminal and type the command below.",
     "command": "claude --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.anthropic.com/claude-code"
   },
   {
    "product": "claude-code",
    "product_name": "Claude Code",
    "platform": "linux",
    "affected_versions": "Claude Code older than 2.1.179",
    "fixed_version": "2.1.179",
    "fixed_min": "2.1.179",
    "fix_note": null,
    "fixed_source_urls": [
     "https://github.com/advisories/GHSA-pq7j-f95f-qfcv",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-86063"
    ],
    "check": {
     "menu_path": "Open Terminal and type the command below.",
     "command": "claude --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.anthropic.com/claude-code"
   }
  ],
  "fix_steps": [
   "Let Claude Code update itself, or run its own update command.",
   "Check that claude --version shows 2.1.179 or newer.",
   "Only install plugins from people you trust."
  ],
  "official_patch_links": [
   {
    "label": "Anthropic: Claude Code",
    "url": "https://www.anthropic.com/claude-code"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://github.com/advisories/GHSA-pq7j-f95f-qfcv",
    "title": "GitHub advisory GHSA-pq7j-f95f-qfcv: Claude Code plugin hash pin bypass",
    "date": "2026-10-15",
    "kind": "ghsa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86063",
    "title": "NVD: CVE-2026-86063",
    "date": "2026-10-13",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}