Plugin4Shell Broke Reviewed Plugin Pins
A repository owner could subvert reviewed plugins: installers trusted checkout without checking the resolved commit. Claude Code, Codex and Copilot could select a hash-shaped default branch; Gemini CLI collided with FETCH_HEAD.
Researchers report the first pair fixed in 2.1.179 and 0.146.0, respectively. Copilot lacked a patch at disclosure. The fourth’s retirement spared enterprise and paid-key access; a fix remains unverified. Researchers recommend Antigravity.
GitHub rejects 40-hex branches; Bitbucket and self-hosting can permit them. Reporters found built-in catalogues on the former. Unprompted upgrades depend on marketplace update policy.
Research demonstrations do not establish hostile exploitation. Agent checks block mismatches; earlier plugin cleanup remains unverified.
Check what executes
- Enforce corrected agent minima.
- Disable unneeded marketplaces; approve repository sources.
- Compare HEAD and tree hashes after checkout.
- Review upstream ownership changes and automatic upgrades.
- Constrain file, credential, terminal and repository access.
- Log source, commit, signer and installation time.
Research: 17 September 2026. Follow-up: 18 September 2026; times unspecified.
