ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0444

ACVE-2026-0444

Changed plugin code could be installed under a reviewed, pinned marketplace plugin revision and run with the user's privileges in Claude Code, Codex, GitHub Copilot and Gemini CLI.

Exposure

Harness
Claude Code, Codex, GitHub Copilot or Gemini CLI with a marketplace plugin installed — confirmed, www.helpnetsecurity.com
Model
any — unconfirmed
Goal
Any coding task that loads an installed plugin (goal not stated by the source) — unconfirmed
Tools and settings
Marketplace plugins and the agent's revision-pinning check — confirmed, aviatrix.ai
Approval
The plugin is trusted and loaded after review and pinning, but the installed code may differ from the reviewed revision — detected, www.helpnetsecurity.com
Input controlled by
package-publisher
What the agent does
The agent installs and runs plugin code that is not the reviewed pinned revision.
Harm
arbitrary-command
Reach
Files, credentials and connected systems available to the agent — confirmed, aviatrix.ai (project files, cloud credentials, the network)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
CRITICAL
Status
Unverified
Kind
Code
Source date
2026-09-18
Modified
2026-09-25
Aliases
No CVE assigned — No CVE was assigned in the public disclosure.
Affected
  • AgentHarness: claude-code — < 2.1.179
  • AgentHarness: codex-cli — < 0.146.0
  • AgentHarness: github-copilot — all versions
  • AgentHarness: gemini-cli — all versions
Harness/product
claude-code + codex-cli + github-copilot + gemini-cli
Classes
supply-chain; rug-pull; tool-poisoning; credential-exposure; CWE-494; CWE-693
Taxonomy
ASI: ASI04; ATLAS: AML.T0109; ATLAS: AML.T0010.005
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

weaponised-poc · research

Description

What

AIR's Plugin4Shell disclosure described a supply-chain defect shared by four coding agents: plugin pinning did not reliably ensure that the installed code matched the reviewed revision. A malicious plugin could then run with the same access as the agent, including access to files, credentials and connected systems.

Detection

AIR demonstrated proof-of-concept exploits against all four agents; the report is not a lab recreation by this registry.

Fix

Upgrade Claude Code to 2.1.179 and Codex to 0.146.0; GitHub Copilot remained unpatched in the report, and Google said Gemini CLI would not be fixed because it was being retired.

Fix

Upgrade patched agents and remove plugins from unpatched agents until their pinning is fixed.

  • Upgrade harness:claude-code to 2.1.179. Version stated by the report. Owner: operator
  • Upgrade harness:codex-cli to 0.146.0. Version stated by the report. Owner: operator

References

REPORT

Report a problemJSON