From Dev.to
Claude Code checked out a plugin's pinned 40-character SHA but never compared HEAD to it, so a branch named like the SHA won
Pinning a dependency to a full commit SHA is supposed to mean this exact code, as reviewed. An October advisory for Claude Code (CVE-2026-86063, fixed in 2.1.179) showed a plugin install that ran git...