npm/@anthropic-ai/claude-code CVE-2026-86063: high 7.5
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Action: Upgrade @anthropic-ai/claude-code to 2.1.179 or later.
npm i @anthropic-ai/claude-code@2.1.179Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.179 | - |
Fixed versions
| 2.1.179 |
Sources
- osv: GHSA-pq7j-f95f-qfcv
- nvd: CVE-2026-86063
- https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv
- https://github.com/anthropics/claude-code
- https://github.com/anthropics/claude-code/releases/tag/v2.1.179
CVE-2026-86063 · published · modified · JSON