What is CVE-2026-77474?

CVE-2026-77474 is a high-severity vulnerability in Dicklesworthstone Destructive Command Guard, classified under Uncontrolled Resource Consumption. CVSS score: 7.1/10. Published 2026-10-16.

How severe is CVE-2026-77474?

High severity. CVSS v3 base score is 7.1 out of 10.

Resource exhaustion in Dicklesworthstone Destructive Command Guard

CVE-2026-77474

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.

Vulnerability class: DoS (Denial of Service)

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Dicklesworthstone Destructive Command Guard — versions < 0.6.6

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-77474?: CVE-2026-77474 is a high-severity vulnerability in Dicklesworthstone Destructive Command Guard, classified under Uncontrolled Resource Consumption. CVSS score: 7.1/10. Published 2026-10-16.
How severe is CVE-2026-77474?: High severity. CVSS v3 base score is 7.1 out of 10.