CVE-2026-77474 json
dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
published 2026-10-16 23 d ago modified 2026-10-19 20 d ago also EUVD-2026-102919
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 d ago
Exploit prediction
0.12% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
Affected products
- Dicklesworthstone destructive_command_guard
Classification
References
- github.com /Dicklesworthstone/destructive_command_guard/commit/ba16bdd074b045329dc0ca6ec9a08c44403cfe1b
- github.com /Dicklesworthstone/destructive_command_guard/security/advisories/GHSA-4cfr-w3v5-w5j5
- github.com /Dicklesworthstone/destructive_command_guard/issues/189
- github.com /Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.6
Sources
- CVE List CVE-2026-77474
- NVD CVE-2026-77474
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.