{
  "entry": {
    "kind": "vuln",
    "slug": "plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code",
    "name": "plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code",
    "vendor": "Claude Code",
    "description": "Air Security (Or Nevo, Dor Granat, Niv Hoffman) published Plugin4Shell on 17 September 2026 (covered by The Register the same day and The Hacker News on 18 September): a plugin SHA-pinning bypass that turns marketplace installs into zero-click remote code execution on Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Each agent checks out the marketplace-pinned commit but never verifies that HEAD actually landed on that commit. On Claude Code, Codex, and Copilot, an attacker who controls the plugin repo can create a branch whose name is the 40-hex pinned SHA, set it as the default branch, and exploit git's \"refname is ambiguous\" preference for a ref over an object id so checkout resolves to attacker-controlled content while the pin still looks honored — a pattern that works on hosts that allow SHA-shaped branch names (Bitbucket and self-hosted git; GitHub rejects those names). Gemini CLI's variant fetches the pin into FETCH_HEAD then runs `git checkout FETCH_HEAD`, which resolves to a default branch named FETCH_HEAD instead of the fetched commit. Plugin auto-update (default on Claude Code and Codex) makes the swap zero-click for already-installed plugins after a marketplace pin bump. Air disclosed to all four vendors in June 2026: Claude Code fixed in 2.1.179 (Anthropic confirmed 17 June), Codex fixed in 0.146.0 (verified 12 August), Gemini CLI will not be patched (deprecated; Google advises migrating to Antigravity), and Copilot remained unpatched at disclosure — GitHub argued GitHub-hosted marketplaces are safe because GitHub forbids SHA-like refs, while Air notes Copilot still supports Bitbucket/self-hosted marketplaces. No CVE was assigned as of the public disclosure.",
    "website": "https://www.air.security/blog-posts/plugin4shell",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-17",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code",
      "aliases": [
        "ti-105"
      ],
      "title": "Plugin4Shell: SHA-Pinning Bypass Gives Zero-Click RCE Across Claude Code, Codex, Copilot, and Gemini CLI",
      "summary": "Air Security (Or Nevo, Dor Granat, Niv Hoffman) published Plugin4Shell on 17 September 2026 (covered by The Register the same day and The Hacker News on 18 September): a plugin SHA-pinning bypass that turns marketplace installs into zero-click remote code execution on Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Each agent checks out the marketplace-pinned commit but never verifies that HEAD actually landed on that commit. On Claude Code, Codex, and Copilot, an attacker who controls the plugin repo can create a branch whose name is the 40-hex pinned SHA, set it as the default branch, and exploit git's \"refname is ambiguous\" preference for a ref over an object id so checkout resolves to attacker-controlled content while the pin still looks honored — a pattern that works on hosts that allow SHA-shaped branch names (Bitbucket and self-hosted git; GitHub rejects those names). Gemini CLI's variant fetches the pin into FETCH_HEAD then runs `git checkout FETCH_HEAD`, which resolves to a default branch named FETCH_HEAD instead of the fetched commit. Plugin auto-update (default on Claude Code and Codex) makes the swap zero-click for already-installed plugins after a marketplace pin bump. Air disclosed to all four vendors in June 2026: Claude Code fixed in 2.1.179 (Anthropic confirmed 17 June), Codex fixed in 0.146.0 (verified 12 August), Gemini CLI will not be patched (deprecated; Google advises migrating to Antigravity), and Copilot remained unpatched at disclosure — GitHub argued GitHub-hosted marketplaces are safe because GitHub forbids SHA-like refs, while Air notes Copilot still supports Bitbucket/self-hosted marketplaces. No CVE was assigned as of the public disclosure.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Supply chain compromise"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/gemini-cli"
      },
      "affected": [
        {
          "range": "Claude Code < 2.1.179 (fixed in 2.1.179). Codex < 0.146.0 (fixed in 0.146.0). GitHub Copilot: unpatched at 17 Sep 2026 disclosure for non-GitHub marketplace backends. Gemini CLI: unpatched permanently (deprecated); migrate to Antigravity.",
          "fixed": "2.1.179"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-17",
      "modifiedAt": "2026-09-17",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.air.security/blog-posts/plugin4shell"
        }
      ],
      "mitigation": "Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later immediately — those are the only complete agent-side fixes. For Copilot, prefer GitHub-hosted marketplaces only (GitHub rejects SHA-shaped branch names) and treat Bitbucket/self-hosted plugin marketplaces as exposed until Microsoft ships a client-side HEAD==pin check. Stop using Gemini CLI; move to Antigravity if you need Google's agent. Disable background plugin auto-update where the product allows it, pin and re-verify plugin trees yourself with `git rev-parse HEAD` after every install/update, and revoke/rotate credentials on any host that had marketplace plugins installed before the fixed floors. A marketplace cannot fully close this: the pin is resolved inside the agent.",
      "detectedByAnomity": true
    }
  }
}