{"metadata": {"vulnerability": "CVE-2026-86063", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-04T19:34:03.099Z", "date_only": false, "value": "2026-09-04T19:34:03.099Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86063", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T19:04:11.695Z", "date_only": false, "value": "2026-10-13T19:04:11.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86063", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:04:11.695Z", "date_only": false, "value": "2026-10-13T19:04:11.695Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-86063", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:21:21Z", "date_only": false, "value": "2026-10-13T19:21:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PQ7J-F95F-QFCV", "record": "GHSA-PQ7J-F95F-QFCV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:21:21.417Z", "date_only": false, "value": "2026-10-13T19:21:21.417", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86063", "record": "FKIE_CVE-2026-86063", "field": "published"}, {"timestamp": "2026-10-13T20:14:06.546Z", "date_only": false, "value": "2026-10-13T20:14:06.546364Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86063", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T20:14:06.546Z", "date_only": false, "value": "2026-10-13T20:14:06.546364Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86063", "record": "FKIE_CVE-2026-86063", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T20:21:00.156Z", "date_only": false, "value": "2026-10-13T20:21:00.156Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86063", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:21:00.156Z", "date_only": false, "value": "2026-10-13T20:21:00.156Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86063", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T21:19:36.730Z", "date_only": false, "value": "2026-10-13T21:19:36.730", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86063", "record": "FKIE_CVE-2026-86063", "field": "lastModified"}, {"timestamp": "2026-10-14T08:15:31.197Z", "date_only": false, "value": "2026-10-14T08:15:31.197003Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117438266129579967", "record": "CVE-2026-86063", "field": "creation_timestamp", "uuid": "5e68d49d-c7dc-4529-bb01-5c2becc473a8", "content": "CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86063https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcvhttps://github.com/anthropics/claude-code/releases/tag/v2.1.179#anthropics #claude-code#CVE_2026_86063#bot", "url": "https://infosec.exchange/users/cve/statuses/117438266129579967"}, {"timestamp": "2026-10-14T12:10:04.298Z", "date_only": false, "value": "2026-10-14T12:10:04.298932Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtjbu4q6z27", "record": "CVE-2026-86063", "field": "creation_timestamp", "uuid": "54e0ef15-a474-46a3-b933-d0fa8e9c1932", "content": "CVE-2026-86063 - claude-code\nClaude Code could download and install a plugin that looks safe but is actually malicious. This happens when a bad actor creates a branch with the same name as a trusted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#claudecode #anthropics #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtjbu4q6z27"}, {"timestamp": "2026-10-15T20:22:07Z", "date_only": false, "value": "2026-10-15T20:22:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PQ7J-F95F-QFCV", "record": "GHSA-PQ7J-F95F-QFCV", "field": "published"}, {"timestamp": "2026-10-15T20:22:07Z", "date_only": false, "value": "2026-10-15T20:22:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PQ7J-F95F-QFCV", "record": "GHSA-PQ7J-F95F-QFCV", "field": "modified"}]}