What happened
CVE-2026-77474 (CVSS 7.1, CWE-400, published 2026-10-16) — nested or unclosed command substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time processing in dcg's scanners; a hung PreToolUse hook fails open, allowing the destructive command that the guard is meant to block to proceed.
Why it matters
This is a bypass of the safety boundary between an AI coding agent and the shell. Because agents routinely feed model-crafted commands through pattern/hook gates like dcg, a payload that triggers the exponential scan plus a fail-open hook turns the guard itself into a non-barrier for destructive operations — and simultaneously gives a trivial DoS against the agent loop.
Attack vector
Local/agent-originated: an agent or user-supplied command containing nested/unclosed $( or $(( substitution sequences triggers recursive rescanning that blows up to exponential time; if the resulting hang hits the PreToolUse hook, it fails open and the destructive command executes unguarded.
Affected systems
destructive_command_guard (dcg) < 0.6.6 — src/packs/mod.rs split_command_segments
Mitigation
Upgrade to dcg 0.6.6+ (fix in commit ba16bdd). No public exploit documented as of 2026-10-16.