Plugin4Shell reportedly lets repository owners swap trusted plugins for malicious code

Air Security says Plugin4Shell can silently replace a trusted plugin with malicious code and auto-install it despite SHA pinning—the mechanism meant to keep a plugin tied to a specific code version. The Next Web reports that a plugin repository’s owner can make the swap without a user click.

A September 21, 2026 post citing Air Security said Claude Code and Codex had fixes, while Copilot had none and Gemini CLI would not be patched. Air Security says addressing the flaw requires an agent update, not a marketplace fix.