CVE-2026-86063

A flaw was found in Claude Code. When installing a plugin pinned to a specific commit hash, the application does not verify that the checked-out version matches the expected Secure Hash Algorithm SHA identifier. A remote attacker controlling a repository can create a branch named after the review...