Plugin4Shell Bypasses Commit Hash Pinning via Git Refspec Ambiguity in Claude Code, Codex, Copilot and Gemini CLI

The core flaw is Git's refspec resolution treating a user-supplied SHA as a branch name when the remote allows it. Air Security demonstrated working exploits against all four agents in May 2026 by creating branches on Bitbucket and self-hosted Git instances that matched the marketplace-pinned commit hashes. The agents reported the pinned version while executing the swapped tree. No CVE has been issued and vendors published no advisories as of 18 September checks.

GitHub blocks SHA-shaped refs, shielding its marketplace plugins, yet Codex and Claude Code still enable background auto-updates from that marketplace by default. Gemini CLI accepts a FETCH_HEAD-named default branch, a vector unaffected by GitHub's naming rule. The attack surface therefore concentrates on any plugin sourced from permissive Git hosts or any agent that auto-refreshes external catalogs.

Evidence trails show the vulnerability is a supply-chain integrity failure at the agent layer, not the marketplace. Each agent performs its own local ref resolution after the marketplace has already locked the SHA; no catalog-side control can mitigate it. This pattern matches prior Git client ambiguities documented in 2018-2022 refname collision CVEs and repeats the same verification omission seen in earlier package-manager attacks.

Operational impact is immediate credential and file-system exposure for any developer who has granted an agent workspace access. Next steps are agent-side enforcement of git fetch --verify or explicit object-ID checks before checkout; absence of such changes by Q4 2026 will leave non-GitHub plugin sources exploitable at scale.