CVE-2026-77474: dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructivecommandguard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through splitcommandsegments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dcgto a version that resolves this vulnerability.Fixed in 0.6.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of destructive_command_guard (dcg) versions before 0.6.6 are affected when dcg processes commands containing nested or unclosed command-substitution sequences such as $( or $((. The impact is particularly relevant where dcg runs as a PreToolUse hook and a hook timeout fails open.
What does an attacker need to trigger the bypass?
An attacker needs to cause dcg to inspect a command that includes a destructive command followed by nested or unclosed $( or $(( sequences. These sequences trigger repeated rescanning of the remaining command suffix, potentially hanging the hook until its timeout behavior allows the command to proceed.
Is there a fix?
Yes. The issue is fixed in dcg version 0.6.6.