destructive_command_guard CVE-2026-77474

Requires dcg (versions prior to 0.6.6) to be deployed as a PreToolUse guard hook for an AI coding agent, and the hook must be configured/operate in a fail-open manner on timeout - which the description states is the case. The triggering input must reach the split_command_segments scanners in src/packs/mod.rs and contain a destructive command combined with nested or unclosed $( or $(( substitution sequences that cause repeated rescanning of the command suffix. Limiting factors that reduce realistic risk: the command must actually be submitted/executed (CVSS UI:R), the vector is local (the attacker influences the command text rather than acting over a network), exploitation depends on the fail-open-on-hang behavior, and only versions before 0.6.6 are affected.

This is a security-control-bypass issue dressed as a denial-of-service (CWE-400). The real danger is not the hang itself but its consequence: dcg is a PreToolUse guard that blocks destructive shell commands for AI coding agents, and when nested/unclosed $( or $(( sequences trigger exponential-time rescanning in the split_command_segments scanners, the hook hangs and fails open - so a destructive command (e.g. rm -rf) proceeds unguarded. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, 7.1) is internally consistent: local attack surface (command text fed to the tool), no privileges, but requiring the command to actually be executed (UI:R), with high integrity/availability impact and no confidentiality impact - which matches a destructive-command bypass rather than data theft. Weighing all signals: no CISA KEV listing, no public exploit identified, no EPSS score supplied, and the affected product is an obscure individual open-source project, so widespread opportunistic exploitation is unlikely. The practical threat model is narrow but meaningful - a prompt-injected or malicious agent crafting a command that is simultaneously destructive and guard-evading - making this a real but context-dependent priority rather than a broad emergency. No key signals conflict; the main gap is the absence of EPSS/KEV/POC data, which is an absence rather than a contradiction.

An AI coding agent is manipulated (e.g. via prompt injection) into proposing a destructive shell command padded with nested or unclosed $( / $(( sequences. When dcg's PreToolUse hook scans it, the scanner recursively rescans the command suffix in exponential time and hangs; the hook times out and fails open, so the destructive command executes without being blocked. No public exploit code was identified at time of analysis.