Destructive Command Guard
Monthly
Algorithmic resource exhaustion in destructive_command_guard (dcg) versions prior to 0.6.6 lets a crafted shell command - a destructive command followed by nested or unclosed $( or $(( substitution sequences - trigger exponential-time rescans in the split_command_segments scanners (src/packs/mod.rs), hanging the process. Because dcg runs as a PreToolUse guard hook for AI coding agents and that hook fails open on timeout, the hang does not block the command but instead allows the destructive command to be executed - turning a denial-of-service bug (CWE-400) into a safety-control bypass with high integrity impact. The issue is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating a local attack path with no privileges required but requiring user interaction (the command must actually be submitted), and the fix is the vendor-released version 0.6.6; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Algorithmic resource exhaustion in destructive_command_guard (dcg) versions prior to 0.6.6 lets a crafted shell command - a destructive command followed by nested or unclosed $( or $(( substitution sequences - trigger exponential-time rescans in the split_command_segments scanners (src/packs/mod.rs), hanging the process. Because dcg runs as a PreToolUse guard hook for AI coding agents and that hook fails open on timeout, the hang does not block the command but instead allows the destructive command to be executed - turning a denial-of-service bug (CWE-400) into a safety-control bypass with high integrity impact. The issue is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating a local attack path with no privileges required but requiring user interaction (the command must actually be submitted), and the fix is the vendor-released version 0.6.6; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.