https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:16:39 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35667 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers can trigger process termination via the !stop command, causing data corruption, resource leaks, and skipped security-sensitive cleanup operations.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers can trigger process termination via the !stop command, causing data corruption, resource leaks, and skipped security-sensitive cleanup operations.</p> https://cve.radiocsirt.org/vuln/cve-2026-35667 https://cve.radiocsirt.org/vuln/ghsa-3298-56p6-rpw2 <p><strong>Affected:</strong> npm: openclaw</p> <p>&gt; Fixed in OpenClaw 2026.3.24, the current shipping release.</p> <p>### Advisory Details **Title**: Incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`</p> <p>**Description**: ### Summary The `!stop` (and `/bash stop`) chat command kills background bash processes using `SIGKILL` directly, without first sending `SIGTERM` to allow graceful shutdown. This is because `bash-command.ts` imports `killProcessTree()` from `src/agents/shell-utils.ts`, which still contains the pre-CVE-2026-27486 aggressive kill logic, rather than from the patched `src/process/kill-tree.ts`.</p> <p>### Details CVE-2026-27486 fixed unsafe process termination by introducing a graceful shutdown sequence in `src/process/kill-tree.ts` — sending `SIGTERM` first, waiting a configurable grace period (default 3 seconds), then escalating to `SIGKILL` only if the process is still alive.</p> <p>However, an identical copy of the **unpatched** `killProcessTree` function remains in `src/agents/shell-utils.ts` (lines 170–192). This function sends `SIGKILL` immediately with no `SIGTERM`:</p> <p>```typescript // src/agents/shell-utils.ts:170-192 export function killProcessTree(pid: number): void { // ... Windows handling ... try { process.kill(-pid, &#34;SIGKILL&#34;); // Immediate hard kill, no SIGTERM } catch { try { process.kill(pid, &#34;SIGKILL&#34;); } catch { // process already dead } } } ```</p> <p>The `!stop` chat command handler in `src/auto-reply/reply/bash-command.ts` imports a…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>&gt; Fixed in OpenClaw 2026.3.24, the current shipping release.</p> <p>### Advisory Details **Title**: Incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`</p> <p>**Description**: ### Summary The `!stop` (and `/bash stop`) chat command kills background bash processes using `SIGKILL` directly, without first sending `SIGTERM` to allow graceful shutdown. This is because `bash-command.ts` imports `killProcessTree()` from `src/agents/shell-utils.ts`, which still contains the pre-CVE-2026-27486 aggressive kill logic, rather than from the patched `src/process/kill-tree.ts`.</p> <p>### Details CVE-2026-27486 fixed unsafe process termination by introducing a graceful shutdown sequence in `src/process/kill-tree.ts` — sending `SIGTERM` first, waiting a configurable grace period (default 3 seconds), then escalating to `SIGKILL` only if the process is still alive.</p> <p>However, an identical copy of the **unpatched** `killProcessTree` function remains in `src/agents/shell-utils.ts` (lines 170–192). This function sends `SIGKILL` immediately with no `SIGTERM`:</p> <p>```typescript // src/agents/shell-utils.ts:170-192 export function killProcessTree(pid: number): void { // ... Windows handling ... try { process.kill(-pid, &#34;SIGKILL&#34;); // Immediate hard kill, no SIGTERM } catch { try { process.kill(pid, &#34;SIGKILL&#34;); } catch { // process already dead } } } ```</p> <p>The `!stop` chat command handler in `src/auto-reply/reply/bash-command.ts` imports a…</p> https://cve.radiocsirt.org/vuln/ghsa-3298-56p6-rpw2