Openclaw cli: OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts` (CVE-2026-35667)

CVE-2026-35667 describes an incomplete fix in OpenClaw CLI for a process termination vulnerability originally addressed in CVE-2026-27486. The vulnerability arises because the `!stop` chat command calls an unpatched `killProcessTree` function from `src/agents/shell-utils.ts` that immediately sends SIGKILL to processes, bypassing the intended graceful shutdown logic implemented in `src/process/kill-tree.ts`. The patched logic sends SIGTERM first, waits a configurable grace period (default 3 seconds), and only then sends SIGKILL if the process remains alive. The presence of the unpatched function allows background bash processes to be killed abruptly without the chance to handle SIGTERM, potentially causing data loss or corruption. The issue affects OpenClaw CLI versions >=2026.1.29 and <2026.3.24 and is fixed in version 2026.3.24.

The vulnerability causes the `!stop` command to kill background bash processes immediately with SIGKILL, preventing them from performing graceful shutdown procedures that rely on SIGTERM signals. This can lead to abrupt termination of processes, potentially causing data loss, corruption, or inconsistent states in applications relying on the OpenClaw CLI. The impact is limited to local process termination behavior and does not affect confidentiality or availability beyond the affected processes.

A fix is available in OpenClaw CLI version 2026.3.24. Users should upgrade to this version or later to ensure the `!stop` command uses the patched killProcessTree function that implements a graceful shutdown sequence. No additional mitigation is required once the update is applied.