// ClaudeHIGH
Plugin4Shell is a supply-chain vulnerability affecting Claude Code's plugin marketplace, disclosed September 17, 2026. Attackers could bypass SHA pinning verification by creating Git branches with names matching commit hashes, allowing malicious plugin code to execute with user privileges. Claude Code patched in version 2.1.179. The vulnerability also affected OpenAI Codex, GitHub Copilot, and Google Gemini CLI.
// Get alerts for Claude