CVE-2026-35667: OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`

March 30, 2026 (updated April 10, 2026)

The !stop (and /bash stop) chat command kills background bash processes using SIGKILL directly, without first sending SIGTERM to allow graceful shutdown. This is because bash-command.ts imports killProcessTree() from src/agents/shell-utils.ts, which still contains the pre-CVE-2026-27486 aggressive kill logic, rather than from the patched src/process/kill-tree.ts.

References

github.com/advisories/GHSA-3298-56p6-rpw2
github.com/advisories/GHSA-jfv4-h8mc-jcp8
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2
nvd.nist.gov/vuln/detail/CVE-2026-35667

Code Behaviors & Features

Detect and mitigate CVE-2026-35667 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →