Claude Code EUVD-2026-100461

Exploitation requires all of the following: the victim must run Claude Code or Claude Desktop prior to version 2.1.179; the victim must actively install the attacker's plugin AND pin it to the reviewed 40-character commit SHA (UI:A); and the attacker must control the plugin repository on a Git host that permits branch names shaped like a 40-hex SHA (the AT:P attack requirement) so a branch can shadow the pinned commit. Limiting factors that reduce realistic risk: the heavy user interaction and trust decision (install + pin a specific hash), the social-engineering needed to get the victim to trust the repo, the non-universal git-host configuration allowing SHA-shaped branch names, and the fact that patched versions (>= 2.1.179) verify HEAD equals the pinned SHA. The attacker needs no privileges on the victim's system (PR:N), but does need write control over the plugin repository.

Signals point to a HIGH-impact but LOW-likelihood issue that is a moderate, conditional priority rather than an emergency. The CVSS 4.0 base score is 7.5 with total technical impact (VC:H/VI:H/VA:H) via CWE-494 (download of code without integrity check), meaning successful exploitation yields full attacker-controlled code execution in the victim's context. However, every likelihood signal is muted: CISA SSVC rates Exploitation as 'none', Automatable as 'no', the GitHub advisory and vendor confirm a patch with no KEV listing, and no public exploit was identified. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap. Crucially, although PR:N (no attacker privileges) could read as 'trivially remote', the vector also carries UI:A (active user interaction) and AT:P (a special attack requirement: a Git host that permits SHA-shaped branch names), so real-world exploitation hinges on social engineering the victim into installing and pinning a malicious plugin. This is a targeted supply-chain / trust-boundary bypass, not a wormable remote flaw. Note also a metadata conflict: the input Tag says 'Information Disclosure', which contradicts CWE-494 and the full C/I/A impact - this is an arbitrary-code-execution/supply-chain weakness, and the tag appears mislabeled.

An attacker publishes a plugin repository on a Git host that allows SHA-shaped branch names and creates a branch named identically to the 40-character commit SHA a victim previously reviewed and trusts. When the victim installs the plugin and pins it to that 'safe' hash, Claude Code's git checkout resolves to the branch tip instead of the immutable commit, silently installing attacker-controlled code that executes in the user's context. No public exploit code was identified at time of analysis, but the technique is straightforward for anyone controlling the plugin repo.