HighVulnerability
CVE-2026-77474: destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-77474
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
destructive_command_guard (dcg), a command-line tool that blocks destructive shell commands before AI coding agents run them, is affected in versions prior to 0.6.6. Nested or unclosed $( and $(( substitutions cause the scanners reached through split_command_segments in src/packs/mod.rs to rescan the command suffix repeatedly, producing exponential-time work. A hung PreToolUse hook then fails open, letting a destructive command proceed.
Mitigation
Fixed in version 0.6.6.
Related items
- MediumCERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During TestingSimilar attack · The Hacker News
- MediumGHSA-hqm2-cfx2-2vgh: Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creationSimilar attack · GitHub Advisory Database
- MediumGHSA-84m7-p3x7-pcfv: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionSimilar attack · GitHub Advisory Database
- MediumCVE-2026-109311: vLLM audio upload heap overflow via FFmpeg IAMF parserSimilar attack · NVD/CVE Database
- MediumCVE-2026-108748: Quarkus LangChain4j memory exhaustion in chat-scopes WebSocketSimilar attack · NVD/CVE Database