CVE-2026-77474: a crafted command could hang dcg, the destructive-command guard for AI coding agents, and get past it

Vulnerability · destructive_command_guard (dcg) · MEDIUM

Incident dateNot stated

DisclosedJul 13–14, 2026 (issue #189, fix and advisory GHSA-4cfr-w3v5-w5j5). Aug 27, 2026 (GHSA-qrvv-jghm-vhph and GHSA-4h58-8v93-p2cx). CVE-2026-77474 published on NVD Oct 16, 2026.

Added hereOct 16, 1:40 PM ET

Last verifiedOct 16, 2026

Summary

destructive_command_guard (dcg) is an open-source hook that checks shell commands before AI coding agents such as Claude Code, Codex CLI, Gemini CLI and Cursor run them, and blocks destructive ones like git reset --hard or rm -rf. Its maintainer has published three advisories since July for ways a command could get past it. The one that now has a CVE, CVE-2026-77474 (published on NVD on Oct 16, 2026), let a destructive command followed by about 30 nested or unclosed $( sequences push dcg's parser into exponential-time work. The hook hung, and because agents fail open when a pre-tool hook times out, the advisory says, the command then ran. dcg 0.6.6 fixes it. Two other advisories, GHSA-qrvv-jghm-vhph and GHSA-4h58-8v93-p2cx, cover hex-escaped program names in ANSI-C quotes being allowed and a repository's own .dcg.toml quietly weakening the user's policy. Both are fixed in 0.6.9.

Severity

MEDIUM Medium (VibeIncidents editorial rating). These flaws defeat an extra safety layer, not the agent itself: someone still has to get the agent to run the crafted command, for example through prompt injection or a repository the developer opens. GitHub, as the CVE numbering authority, scores CVE-2026-77474 CVSS 3.1 7.1 High (local, user interaction required), and the maintainer rates all three advisories High. All three were fixed in July, and we found no reports of exploitation.

Timeline

Jul 13, 2026
@spartan8806 reports the exponential-time hang in dcg issue #189. The fix is committed and dcg v0.6.6 is released the same day (UTC).
Jul 14, 2026
The maintainer publishes advisory GHSA-4cfr-w3v5-w5j5 for the hang, affecting versions before 0.6.6 (UTC).
Jul 15, 2026
@KovachVL reports the ANSI-C quoting bypass (issue #217) and the repository config override (issue #218).
Jul 18, 2026
One fix commit closes both, and dcg 0.6.9 is published to crates.io.
Aug 27, 2026
The maintainer publishes advisories GHSA-qrvv-jghm-vhph and GHSA-4h58-8v93-p2cx, both rated High, for versions 0.2.0 through 0.6.8.
Oct 16, 2026
CVE-2026-77474 is published on NVD with a CVSS 3.1 score of 7.1 from GitHub. The two August advisories have no CVE yet.

How it happened

dcg sits in the agent's pre-tool hook: the agent hands it each shell command, and dcg allows or blocks it. Before 0.6.6, the code that finds the end of a $( command substitution, and the $(( arithmetic form, recursed into each nested opener. When the inner scan came back unterminated, it stepped forward one byte and rescanned the rest of the string, so the work doubled with every extra opener. The advisory says a payload of about 90 bytes hung dcg indefinitely, and that a hook that hangs or errors lets the agent go ahead. Because the trigger is the text of the command, an injected instruction telling the agent to tack a run of $( onto a destructive command turns a slow code path into a bypass. The 0.6.9 fixes close two separate gaps. dcg checked the literal spelling of a program name before decoding Bash's ANSI-C quoting, so a destructive program written with hex escapes inside $'...' looked unfamiliar and was allowed, while Bash ran it normally. And dcg loaded a .dcg.toml it found in the repository and ranked it above user and system settings, so a cloned repository could add allow rules without a prompt, and the change did not show in the usual allowlist listing. From 0.6.9 on, a repository's config can only tighten the policy unless you point DCG_CONFIG at it yourself.

How to check your app

Check the dcg version on each machine where your agents run and update to the current release. Anything older than 0.6.9 is missing at least one of these fixes.
Before running an agent in a repository you didn't write, look for a .dcg.toml at its root. On a version older than 0.6.9, review or remove it first.
If you'd rather dcg block than allow when it can't make sense of a command, the advisory mentions DCG_FAIL_CLOSED=1. It also notes that this setting alone did not stop the hang in affected versions.
Treat a command guard as one layer. Keep your agent's own approval prompts on for destructive commands, and commit and back up work so a missed rm -rf or git reset --hard can be undone.

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.