// ClaudeHIGH
Plugin4Shell, a supply-chain vulnerability affecting Claude Code and other AI coding agents, allows attackers to replace SHA-pinned plugins with malicious code via Git reference name ambiguity. Affected agents fail to verify that checked-out code matches the pinned commit, enabling zero-click remote code execution when plugins are automatically updated. Anthropic patched Claude Code in version 2.1.179; users should upgrade immediately and review installed plugin repositories.
- Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and(opens in a new tab)
- Plugin4Shell Flaw Hits Claude Code, Codex, Copilot and Gemini CL(opens in a new tab)
- Plugin4Shell SHA-Pinning Bypass Hits 4 AI Coding Agents(opens in a new tab)
// Get alerts for Claude