Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

A newly disclosed vulnerability known as Plugin4Shell reveals a supply chain weakness in major AI coding agents. This flaw allows attackers to replace trusted, SHA-pinned plugins with malicious code, enabling remote code execution without user interaction.

Researchers Or Nevo, Dor Granat, and Niv Hoffman have identified that the issue impacts Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI.

The vulnerability undermines a critical security measure used by plugin marketplaces and enterprise security teams: pinning an add-on to a specific Git commit that has been reviewed and approved.

Plugin4Shell Zero-Click RCE

AI agent plugins, skills, and extensions often run with the permissions of the developer operating the agent. This may include access to source code, secrets, cloud environments, production systems, internal services, and sensitive enterprise data.

In a standard secure workflow, a marketplace or organization reviews a plugin at a specific Git commit and records that commit’s SHA hash. The agent should then retrieve the exact reviewed code.

However, Plugin4Shell breaks this assumption. Affected agents request the pinned SHA during Git checkout but fail to verify that the checked-out working tree corresponds to that SHA. This creates an opportunity for Git reference name ambiguity.

For Claude Code, Codex, and GitHub Copilot, an attacker can create a branch with the same 40-character hexadecimal name as a pinned commit.

If that branch is set as the default branch of the repository, Git may resolve the branch name instead of the intended commit hash. As a result, the agent could install attacker-controlled code while appearing to have successfully installed the code linked to the trusted pin.

Gemini CLI reportedly has a similar issue. Its installation process fetches a pinned commit but then checks out FETCH_HEAD. If an attacker creates a default branch named FETCH_HEAD, Git can resolve that branch instead of the fetched commit.

The attack is classified as zero-click because several coding agents automatically update previously installed plugins. An attacker could publish a seemingly benign plugin, get marketplace approval, and wait for adoption.

Once a routine marketplace update modifies the pinned version, the attacker could alter the upstream repository so that the new pin resolves to a malicious branch. Background plugin updates could then deploy the malicious code to affected systems without requiring installation prompts, user clicks, or any other warnings.

Researchers also noted that attackers could hijack an existing maintainer’s repository, turning a legitimate, widely used plugin into a delivery vehicle for attacks. This suggests that organizations that review plugin code and depend on commit pinning may still be vulnerable if their agent does not validate the final checked-out commit.

Patches and Mitigation

The fundamental solution is straightforward: agents must verify the commit that is actually checked out after installation with the following check:

test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort

This verification must occur on the endpoint, within the agent itself, because marketplaces cannot reliably enforce how a local Git client resolves a pin.

As of this writing, Anthropic has patched Claude Code in version 2.1.179, and OpenAI has addressed the vulnerability in Codex 0.146.0. Microsoft had not yet released a fix for GitHub Copilot at the time of disclosure, and Google reportedly will not patch the deprecated Gemini CLI, advising users to migrate away from it.

Organizations should promptly update supported coding agents, inventory installed plugins, restrict access to unvetted Git hosting sources, and review repository ownership and default branch settings for existing agent extensions.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC