CVE-2026-77474: CWE-400: Uncontrolled Resource Consumption in Dicklesworthstone destructive_command_guard
Description
CVE-2026-77474 is a high-severity vulnerability in the destructive_command_guard (dcg) tool prior to version 0.6.6. The flaw involves uncontrolled resource consumption caused by recursive rescanning of nested or unclosed shell command substitutions, leading to exponential-time processing. This can cause a hang in the PreToolUse hook, which then fails open and allows destructive commands to execute. The issue is fixed in version 0.6.6.
CVSS v3.1
Score 7.1high
Affected software
Dicklesworthstone
destructive_command_guard
pkg:cargo/github/Dicklesworthstone/destructive_command_guardRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in destructive_command_guard versions before 0.6.6 arises from the handling of nested or unclosed $( or $(( shell substitution sequences. When such sequences are present, the tool recursively rescans the command suffix multiple times, resulting in exponential-time resource consumption (CWE-400). This uncontrolled recursion can cause the PreToolUse hook to hang and fail open, thereby permitting potentially destructive shell commands to run unchecked. The affected code path involves split_command_segments in src/packs/mod.rs. The issue has been addressed and fixed in version 0.6.6.
Potential Impact
An attacker or user providing commands with nested or unclosed shell substitution sequences can cause the tool to consume excessive resources, leading to a hang in the PreToolUse hook. This failure mode causes the safety mechanism to fail open, allowing destructive shell commands to execute without blocking. This can result in high impact due to the execution of destructive commands and denial of service of the safety tool.
Mitigation Recommendations
Upgrade destructive_command_guard to version 0.6.6 or later, where this uncontrolled resource consumption vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T20:07:49.963Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad252552cdf04f6560adcde
Added to database: 10/16/2026, 16:35:33 UTC
Last enriched: 10/16/2026, 16:48:21 UTC
Last updated: 10/16/2026, 16:49:21 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.