The flaw in destructive_command_guard arises when a maliciously crafted command string contains nested or unclosed command‑substitution sequences such as $( or $((. The scanner repeatedly rescans the remainder of the command after each unterminated substitution, creating exponential‑time work. This can cause the PreToolUse hook to hang and, because the hook times out in a fail‑open manner, the protective guard is bypassed and the destructive command is allowed to run. The bug manifests only in versions prior to 0.6.6 and was addressed by patching the scanning logic in v0.6.6.

The vulnerability affects the destructive_command_guard utility published by Dicklesworthstone, specifically any installation built from source or packaged that uses the scanning component in src/packs/mod.rs. All releases before version 0.6.6 are affected; later versions contain the fix. Users who employ this tool to safeguard AI coding agent executions are at risk.

The CVSS score of 7.1 indicates that the flaw can be exploited with moderate effort and carries significant impact. Because the Exploit Prediction Scoring System score is not available, we cannot precisely gauge real‑world exploitation probability, but the absence of a KEV listing and lack of external exploitation reports suggests the exploit is not currently actively deployed. The vulnerability is local to any environment where destructive_command_guard runs, so an attacker who can influence the command string, such as a compromised AI agent or a malicious user with write access, could trigger the denial‑of‑service and bypass. Users should assume that the failure‑open behavior can lead to arbitrary destructive command execution.