CVE-2026-77474

high

EUVD alias: EUVD-2026-102919

Assigned by CNA: github_m

Published 2026-10-16 · Modified 2026-10-16

Discuss on Community Propose mitigation

CVSS v3

7.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.1

Description

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.

Predictions

Exploit likelihood

70%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

References

CWEs

CWE-400 CWE-407 CWE-693

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.