Hasty Briefsbeta

Bilingual

Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents

5 hours ago
  • Plugins and skills in AI agents act as applications, inheriting the user's full permissions, enabling malicious plugins to achieve remote code execution without privilege escalation.
  • The industry previously used SHA pinning as a defense against supply chain attacks, but Plugin4Shell bypasses this by exploiting unchecked git checkout operations, allowing malicious code execution.
  • This vulnerability affects Claude Code, Codex, GitHub Copilot, and Gemini CLI, with zero-click remote code execution via auto-update mechanisms.
  • Two exploitation methods exist: publishing a benign plugin and later making it malicious, or hijacking an existing legitimate plugin's repository.
  • The flaw lies in the agent failing to verify that the checked-out commit matches the pinned SHA, exploitable via branch names matching the SHA or a default branch named 'FETCH_HEAD'.
  • Patches are available for Claude Code and Codex, but GitHub Copilot remains unpatched, and Gemini CLI is deprecated without a fix.
  • A single assertion after checkout—validating the actual HEAD against the pinned SHA—can prevent both attack variants, but it must be implemented agent-side.