The weakness lies in the plugin installation flow of Claude Code, where a git checkout is performed for a marketplace‑pinned commit but the resulting HEAD is never verified against the expected 40‑character SHA. Because of this, an attacker who can control a plugin repository on a Git host that allows SHA‑shaped branch names can create a branch whose name matches the pinned hash. The checkout will then move the repository to that branch tip, thereby installing attacker‑controlled plugin code under the guise of a legitimate, hashed update. Once installed, the plugin can run arbitrary code with the same privileges as the user, effectively granting the attacker remote code execution on the client machine.

Current installations of Anthropics Claude Code and Claude Desktop running any version earlier than 2.1.179 are affected. The patch that addresses the issue was released in version 2.1.179.

The CVSS base score of 7.5 indicates high severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, implying that publicly known exploits are not yet reported. However, exploitation requires an attacker to supply a malicious plugin repository and persuade a user to install that plugin. If those conditions are met, the attacker can execute arbitrary code on the client system.