Posts tagged #claude-code

Plugin4Shell: 'Pinned to a SHA' Was a Lie Your Coding Agent Told You

Plugin4Shell turned SHA-pinned plugins into zero-click RCE across Claude Code, Codex, Copilot, and Gemini CLI. The git trick, patch scoreboard, and the fix.