{"id":"CVE-2026-77474","kind":"vulnerability","aliases":["CVE-2026-77474"],"related":[],"title":"dcg: crafted shell substitutions hang safety hook, letting destructive commands through","description":"destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.","summary":"destructive_command_guard (dcg) is a safety tool that blocks destructive shell commands before AI coding agents run them. Before 0.6.6, nested or unclosed $( and $(( substitutions trigger exponential rescanning, so the PreToolUse hook hangs and fails open, letting the destructive command run.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agents","ai-tooling","claude-code","dcg","shell"],"not_affected_if":["dcg-not-installed","version-0.6.6-or-later"],"how_to_check":"- Run `dcg --version` and confirm it reports a version earlier than `0.6.6`.\n- Check whether dcg is wired into a PreToolUse hook for your coding agent (unknown how to find this from the sources).","fix":"- Upgrade destructive_command_guard (dcg) to `0.6.6` or later.","status":"open","published_at":"2026-10-16T17:17:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:41+00:00","updated_at":"2026-10-25T03:36:41+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:36:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade destructive_command_guard (dcg) to `0.6.6` or later.","reach":"local","title":"dcg: crafted shell substitutions hang safety hook, letting destructive commands through","impact":"high","summary":"destructive_command_guard (dcg) is a safety tool that blocks destructive shell commands before AI coding agents run them. Before 0.6.6, nested or unclosed $( and $(( substitutions trigger exponential rescanning, so the PreToolUse hook hangs and fails open, letting the destructive command run.","category":"ai-tooling","nicknames":[],"who_cares":["dcg","claude-code","ai-coding-agents","shell"],"confidence":0.7,"needs_auth":"unknown","worst_case":"destructive shell commands execute unchecked when the safety hook hangs","analyst_note":"","how_to_check":"- Run `dcg --version` and confirm it reports a version earlier than `0.6.6`.\n- Check whether dcg is wired into a PreToolUse hook for your coding agent (unknown how to find this from the sources).","needs_analyst":false,"not_affected_if":["dcg-not-installed","version-0.6.6-or-later"],"who_is_affected":"Teams running destructive_command_guard before 0.6.6 as a PreToolUse hook for AI coding agents. The flaw is triggered by a destructive command followed by nested or unclosed $( or $(( sequences, so exposure depends on the agent feeding such commands to the hook. Teams not using dcg, or on 0.6.6 or later, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000635,"input_tokens":3443,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77474':13A,16A '0.6.6':49B,95C,166C 'affect':115C 'agent':20B,45B,90C 'ai':18B,22B,43B,88C 'ai-coding-ag':17B 'ai-tool':21B 'allow':154C 'block':38B,83C 'caus':140C 'claud':25B 'claude-cod':24B 'code':19B,26B,44B,89C 'command':10A,30B,41B,69B,72C,78C,86C,121C,127C,146C,157C 'command-lin':77C 'craft':2A 'cve':11A,14A 'dcg':1A,27B,32B,74C 'destruct':9A,29B,39B,68B,71C,84C,126C,156C 'exponenti':56B,111C 'exponential-tim':110C 'fail':64B,152C 'fix':163C 'follow':128C 'guard':31B,73C 'hang':5A,62B 'hook':7A,61B,151C 'hung':149C 'inner':105C 'issu':161C 'let':8A,66B 'line':79C 'nest':50B,96C,130C,135C 'open':65B,153C 'pretoolus':60B,150C 'prior':93C 'proceed':159C 'produc':109C 'reach':118C 'recurs':101C 'remain':145C 'repeat':141C 'rescan':57B,102C,142C 'return':107C 'run':46B,70B,91C 'safeti':6A,35B,80C 'scan':106C 'scanner':116C 'segment':122C 'sequenc':134C,139C 'shell':3A,28B,40B,85C 'split':120C 'src/packs/mod.rs':124C 'substitut':4A,54B,99C 'suffix':147C 'time':112C 'tool':23B,36B,81C 'trigger':55B 'unclos':52B,98C,132C,137C 'untermin':108C 'version':165C 'work':113C","nicknames":[],"mitigations":[],"who_affected":"Teams running destructive_command_guard before 0.6.6 as a PreToolUse hook for AI coding agents. The flaw is triggered by a destructive command followed by nested or unclosed $( or $(( sequences, so exposure depends on the agent feeding such commands to the hook. Teams not using dcg, or on 0.6.6 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77474","severity":null,"published_at":"2026-10-16T17:17:50+00:00","modified_at":"2026-10-19T13:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}