Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

GBHackersby Divya ()3 min read5 · 1 read
Read at gbhackers.com
AI summary · glm-5.3-flashSummaries by Vani AI

Plugin4Shell flaw lets attackers swap SHA-pinned plugins for malicious code, enabling zero-click RCE in Claude Code, Codex, Copilot, and Gemini CLI.

Researchers Or Nevo, Dor Granat, and Niv Hoffman found that Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI fetch a pinned commit SHA but fail to verify the checked-out working tree, letting an attacker-created branch with the same 40-character hex name (or FETCH_HEAD for Gemini CLI) resolve to attacker-controlled code. Because coding agents auto-update installed plugins, the malicious swap can deploy without user interaction and execute with developer-level access to source code, secrets, and cloud environments. Anthropic patched Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0; Microsoft had not patched GitHub Copilot at disclosure, and Google will not patch the deprecated Gemini CLI.

Key facts
  • Agents fetch pinned SHAs but never verify the checked-out tree, enabling Git branch-name ambiguity attacks.
  • Claude Code patched in 2.1.179 and Codex in 0.146.0; GitHub Copilot unpatched at disclosure.
  • Google will not patch deprecated Gemini CLI and advises users to migrate away.
  • Plugins run with developer permissions, exposing source code, secrets, and cloud environments.
  • Mitigation is an endpoint-side check that git rev-parse HEAD equals the pinned SHA.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ai-agentsclaude-codecodexgemini-cligithub-copilotplugin4shellrcesupply-chain
Vendors
AnthropicOpenAIGoogleMicrosoft
Products
Claude CodeCodexGitHub CopilotGemini CLI
Malware
Plugin4Shell
Organizations
AnthropicOpenAIGoogleMicrosoft

From the original article

3 min read at gbhackers.com

A newly disclosed vulnerability known as Plugin4Shell reveals a supply chain weakness in major AI coding agents. This flaw allows attackers to replace trusted, SHA-pinned plugins with malicious code, enabling remote code execution without user interaction. Researchers Or Nevo, Dor Granat, and Niv Hoffman have identified that the issue impacts Anthropic Claude Code, OpenAI Codex, […]

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.