Claude Code Plugin Hash Pinning Bypass

Anthropic's Claude Code and Claude Desktop (v2.1.179 and earlier) contained a vulnerability in the plugin installation flow that allowed attackers to bypass cryptographic hash pinning. The software executed a git checkout to retrieve a pinned commit SHA but failed to verify that the resulting HEAD matched the expected identifier. An attacker controlling a plugin's upstream git repository could create a branch named identically to the 40-character commit SHA being pinned. When the client performed the checkout, the git binary silently resolved the reference to the malicious branch tip rather than the intended commit, leading to the execution of unverified, attacker-controlled code within the user's environment. This vulnerability affects all environments where these tools are deployed, including Windows, macOS, and Linux. Users who have enabled automatic updates have already received the patch, while manual installers must ensure they are running versions 2.1.179 or later.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user running Claude Code or Claude Desktop. Because this occurs during the installation or updating of plugins, the impact is a supply chain compromise where users believe they are installing a specific, verified version of a tool while actually deploying malicious code. This could lead to local data exfiltration, unauthorized API access, or persistence on the developer workstation.

Recommendation

• Update Claude Code and Claude Desktop to version 2.1.179 or later immediately.
• Review installed plugins in local environments to ensure integrity; verify that the git remotes and current HEADs align with known-good upstream states.
• Audit logs for unexpected git process executions originating from the Claude environment if manual updates are lagging behind current deployments.
• Implement a policy to only install plugins from trusted, verified repository sources until all systems are patched to the secure version.