destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and because agents fail open on a hung hook the destructive command is let through; fixed in 0.6.6 on 13 July 2026, CVE (Common Vulnerabilities and Exposures) record published 16 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | not evidenced in source | assertion | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | low |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | low |
| Actor | destructive_command_guard (dcg) before 0.6.6, a command-line safety tool that blocks destructive shell commands before AI coding agents run them, invoked as a PreToolUse hook | fact | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | high |
| Inputs | A destructive command followed by nested or unclosed $( or $(( sequences | fact | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | high |
| Decision | dcg's scanners, reached through split_command_segments in src/packs/mod.rs, recursively rescan nested or unclosed substitutions after an inner scan returns unterminated, repeatedly rescanning the remaining command suffix and producing exponential-time work, so the hook hangs instead of returning a block decision | fact | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | high |
| Envelope: constraints | dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget | fact | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1; Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard); CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026); README.md at tag v0.6.5 (the last affected release), Dicklesworthstone/destructive_command_guard: 'Any command exceeding this threshold is immediately allowed with a warning logged'; Issue #189, Dicklesworthstone/destructive_command_guard: reporter's timings of the exponential hang and the maintainer's reply ('dcg's documented design is fail-open for workflow continuity') | high |
| Action | dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command | fact | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1; Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard) | high |
| Outcome | State: averted by disclosure. No exploitation reported in the sources; the US Cybersecurity and Infrastructure Security Agency's enrichment of the CVE record (19 October 2026) records exploitation as 'none'. As of Oct 2026. | assertion | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1; CVE record CVE-2026-77474 (assigner GitHub, advisory GHSA-4cfr-w3v5-w5j5) as mirrored by OpenCVE: dates, CVSS vector, CWE-400/407/693, affected range, references | medium |
| Evidence: event | Maintainer's GitHub security advisory GHSA-4cfr-w3v5-w5j5 published 14 July 2026, crediting reporter @spartan8806 'with a clear reproduction and complexity analysis'; CVE (Common Vulnerabilities and Exposures) record CVE-2026-77474 published 16 October 2026 with GitHub as CVE numbering authority; CVSS (Common Vulnerability Scoring System) version 3.1 score 7.1, High, assigned by GitHub (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H: local access, low complexity, no privileges, user interaction required, high impact on integrity and availability); weaknesses CWE-400 (uncontrolled resource consumption), CWE-407 (inefficient algorithmic complexity) and CWE-693 (protection mechanism failure) in the Common Weakness Enumeration; affected versions before 0.6.6 | fact | Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard); NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1; CVE record CVE-2026-77474 (assigner GitHub, advisory GHSA-4cfr-w3v5-w5j5) as mirrored by OpenCVE: dates, CVSS vector, CWE-400/407/693, affected range, references | high |
| Recovery: technical | Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict | fact | Dicklesworthstone/destructive_command_guard on GitHub: commit ba16bdd, 'fix: triage batch — exponential-hang guard bypass, path-scoped allowlists, heredoc/pack false positives, pack display', 13 July 2026; first released in tag v0.6.6 (13 July 2026); CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026); Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard); NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1; CVE record CVE-2026-77474 (assigner GitHub, advisory GHSA-4cfr-w3v5-w5j5) as mirrored by OpenCVE: dates, CVSS vector, CWE-400/407/693, affected range, references | high |
| Recovery: accountability | According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass' | assertion | Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard); CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, so the hook hung without a decision, and the advisory states the agent then proceeds with the command. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others; the maintainer reports that after the fix the same payload 'now blocks in well under a millisecond'. Source shows it failed: the reporter's reproduction measured the hang, and the advisory and CVE record state the hung guard lets the destructive command proceed; the sources read do not show an agent running a destructive command. | C-E3 Destructive-action gate |
| failed | Mechanism: dcg's own 200-millisecond budget did not fire during this preprocessing, so dcg returned no decision (by its documented design dcg allows a command that runs past that budget), and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown. | C-D2 Halt and hand off on uncertainty or refusal |
Inference
inference The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own 200-millisecond budget did not fire during the slow step, and by dcg's documented fail-open design a command that runs past that budget is allowed anyway; the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-77474 | NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1 | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| CVE-77474 | CVE record CVE-2026-77474 (assigner GitHub, advisory GHSA-4cfr-w3v5-w5j5) as mirrored by OpenCVE: dates, CVSS vector, CWE-400/407/693, affected range, references | public record secondary | app.opencve.io ↗ checked 2026-10-21 |
| GHSA | Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard) (interest: maintainer describing its own software) | company primary record | github.com ↗ checked 2026-10-21 |
| DCG-FIX | Dicklesworthstone/destructive_command_guard on GitHub: commit ba16bdd, 'fix: triage batch — exponential-hang guard bypass, path-scoped allowlists, heredoc/pack false positives, pack display', 13 July 2026; first released in tag v0.6.6 (13 July 2026) (interest: maintainer describing its own software) | company primary record | github.com ↗ checked 2026-10-21 |
| DCG-CHANGELOG | CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026) (interest: maintainer describing its own software) | company primary record | github.com ↗ checked 2026-10-21 |
| DCG-README-065 | README.md at tag v0.6.5 (the last affected release), Dicklesworthstone/destructive_command_guard: 'Any command exceeding this threshold is immediately allowed with a warning logged' (interest: maintainer describing its own software) | company primary record | raw.githubusercontent.com ↗ checked 2026-10-21 |
| DCG-ISSUE-189 | Issue #189, Dicklesworthstone/destructive_command_guard: reporter's timings of the exponential hang and the maintainer's reply ('dcg's documented design is fail-open for workflow continuity') (interest: reporter's reproduction (spartan8806), with the maintainer's reply describing its own software) | company primary record | github.com ↗ checked 2026-10-21 |