diff --git a/cli_tool_framework/frameworks/js/napi/cli_tool_manager/src/js_cli_session_event_callback.cpp b/cli_tool_framework/frameworks/js/napi/cli_tool_manager/src/js_cli_session_event_callback.cpp
index d2c9e82a1d..0d79ea9bf8 100644
--- a/cli_tool_framework/frameworks/js/napi/cli_tool_manager/src/js_cli_session_event_callback.cpp
+++ b/cli_tool_framework/frameworks/js/napi/cli_tool_manager/src/js_cli_session_event_callback.cpp
@@ -67,6 +67,7 @@ void JsCliSessionEventCallbackImpl::FreeNativeReference(std::unique_ptr<NativeRe
 
     uv_work_t *work = new (std::nothrow) uv_work_t;
     if (work == nullptr) {
+        reference.reset();
         return;
     }
     work->data = reinterpret_cast<void *>(reference.release());
@@ -140,4 +141,4 @@ void JsCliSessionEventCallbackImpl::OnToolEvent(const std::string &sessionId,
 }
 
 } // namespace CliTool
-} // namespace OHOS
\ No newline at end of file
+} // namespace OHOS
diff --git a/cli_tool_framework/interfaces/cli_tool/src/cli_tool_mgr_client.cpp b/cli_tool_framework/interfaces/cli_tool/src/cli_tool_mgr_client.cpp
index 60e5894939..16acd1c247 100644
--- a/cli_tool_framework/interfaces/cli_tool/src/cli_tool_mgr_client.cpp
+++ b/cli_tool_framework/interfaces/cli_tool/src/cli_tool_mgr_client.cpp
@@ -215,7 +215,7 @@ bool CliToolMGRClient::LoadCliToolMgrService()
         return false;
     }
 
-    sptr<CliMgrLoadCallback> loadCallback = new (std::nothrow) CliMgrLoadCallback();
+    sptr<CliMgrLoadCallback> loadCallback = sptr<CliMgrLoadCallback>::MakeSptr();
     if (loadCallback == nullptr) {
         TAG_LOGE(AAFwkTag::CLI_TOOL, "Create load callback failed");
         return false;
diff --git a/cli_tool_framework/services/climgr/src/cli_tool_manager_service.cpp b/cli_tool_framework/services/climgr/src/cli_tool_manager_service.cpp
index 927291936c..33c07f956a 100644
--- a/cli_tool_framework/services/climgr/src/cli_tool_manager_service.cpp
+++ b/cli_tool_framework/services/climgr/src/cli_tool_manager_service.cpp
@@ -206,11 +206,17 @@ void CliToolManagerService::Init()
             EventDispatcher::GetInstance().DispatchInputReplyEvent(record->callerPid, record->callerUid, eventId,
                 result ? ERR_OK : ERR_CLI_SEND_MESSAGE);
         });
-        ioMonitor_->SetSessionClosedCallback([this](const std::string &sessionId, bool isStdout) {
-            HandleOutputClosed(sessionId, isStdout);
+        ioMonitor_->SetSessionClosedCallback([](const std::string &sessionId, bool isStdout) {
+            auto service = CliToolManagerService::GetInstance();
+            if (service != nullptr) {
+                service->HandleOutputClosed(sessionId, isStdout);
+            }
         });
-        ioMonitor_->SetSessionDrainedCallback([this](const std::string &sessionId) {
-            HandleOutputDrained(sessionId);
+        ioMonitor_->SetSessionDrainedCallback([](const std::string &sessionId) {
+            auto service = CliToolManagerService::GetInstance();
+            if (service != nullptr) {
+                service->HandleOutputDrained(sessionId);
+            }
         });
         ioMonitor_->Start();
     }
diff --git a/cli_tool_framework/services/climgr/src/io_monitor.cpp b/cli_tool_framework/services/climgr/src/io_monitor.cpp
index c4d8ac7630..64bdbd797d 100644
--- a/cli_tool_framework/services/climgr/src/io_monitor.cpp
+++ b/cli_tool_framework/services/climgr/src/io_monitor.cpp
@@ -64,7 +64,10 @@ bool IOMonitor::Start()
         TAG_LOGE(AAFwkTag::CLI_TOOL, "epoll_create1 failed: %{public}s", strerror(errno));
         return false;
     }
-    monitorThread_ = std::thread(&IOMonitor::MonitorLoop, this);
+    auto monitor = shared_from_this();
+    monitorThread_ = std::thread([monitor]() {
+        monitor->MonitorLoop();
+    });
     return true;
 }
 
diff --git a/cli_tool_framework/services/climgr/src/tool_util.cpp b/cli_tool_framework/services/climgr/src/tool_util.cpp
index 5f9c596d31..8fd9e3a675 100644
--- a/cli_tool_framework/services/climgr/src/tool_util.cpp
+++ b/cli_tool_framework/services/climgr/src/tool_util.cpp
@@ -132,6 +132,10 @@ int32_t ToolUtil::ValidateInputSchemaProperties(const std::string &inputSchema,
         // Validate type if specified in schema
         auto &propertySchema = properties[key];
         if (propertySchema.contains("type")) {
+            if (!propertySchema["type"].is_string()) {
+                TAG_LOGE(AAFwkTag::CLI_TOOL, "args key '%{public}s' has invalid schema type", key.c_str());
+                return ERR_INVALID_PARAM;
+            }
             std::string expectedType = propertySchema["type"].get<std::string>();
             if (!ValidateParamType(value, expectedType, propertySchema, key)) {
                 TAG_LOGE(AAFwkTag::CLI_TOOL, "args key '%{public}s' type mismatch, expected: %{public}s",
@@ -440,7 +444,14 @@ bool ToolUtil::ValidateArrayItems(sptr<AAFwk::IArray> arrayObj,
     if (arrayObj->GetLength(arrayLength) != ERR_OK || arrayLength == 0) {
         return true;
     }
-    std::string itemType = itemsSchema.value("type", "");
+    if (!itemsSchema.contains("type")) {
+        return true;
+    }
+    if (!itemsSchema["type"].is_string()) {
+        TAG_LOGE(AAFwkTag::CLI_TOOL, "Array '%{public}s' has invalid item schema type", key.c_str());
+        return false;
+    }
+    std::string itemType = itemsSchema["type"].get<std::string>();
     if (itemType.empty()) {
         return true;
     }
diff --git a/cli_tool_framework/test/unittest/tool_util_test/tool_util_test.cpp b/cli_tool_framework/test/unittest/tool_util_test/tool_util_test.cpp
index 852bbfe571..5b81d64071 100644
--- a/cli_tool_framework/test/unittest/tool_util_test/tool_util_test.cpp
+++ b/cli_tool_framework/test/unittest/tool_util_test/tool_util_test.cpp
@@ -869,6 +869,20 @@ HWTEST_F(ToolUtilTest, ValidateInputSchemaProperties_TypeValidation_1100, TestSi
     GTEST_LOG_(INFO) << "ToolUtil_ValidateInputSchemaProperties_TypeValidation_1100 end";
 }
 
+/**
+ * @tc.name: ToolUtil_ValidateInputSchemaProperties_TypeValidation_1200
+ * @tc.desc: Test ValidateInputSchemaProperties rejects a non-string schema type
+ * @tc.type: FUNC
+ */
+HWTEST_F(ToolUtilTest, ValidateInputSchemaProperties_TypeValidation_1200, TestSize.Level1)
+{
+    AAFwk::WantParams args;
+    args.SetParam("target", AAFwk::String::Box("device"));
+
+    EXPECT_EQ(ToolUtil::ValidateInputSchemaProperties(
+        R"({"properties":{"target":{"type":123}}})", args), ERR_INVALID_PARAM);
+}
+
 /**
  * @tc.name: ToolUtil_ValidateInputSchemaProperties_NestedObject_0100
  * @tc.desc: Test ValidateInputSchemaProperties with nested object validation
@@ -1120,6 +1134,23 @@ HWTEST_F(ToolUtilTest, ValidateInputSchemaProperties_ArrayItems_0300, TestSize.L
     GTEST_LOG_(INFO) << "ToolUtil_ValidateInputSchemaProperties_ArrayItems_0300 end";
 }
 
+/**
+ * @tc.name: ToolUtil_ValidateInputSchemaProperties_ArrayItems_0400
+ * @tc.desc: Test array schema rejects a non-string item type
+ * @tc.type: FUNC
+ */
+HWTEST_F(ToolUtilTest, ValidateInputSchemaProperties_ArrayItems_0400, TestSize.Level1)
+{
+    AAFwk::WantParams args;
+    sptr<AAFwk::IArray> array = sptr<AAFwk::Array>::MakeSptr(1, AAFwk::g_IID_IString);
+    ASSERT_NE(array, nullptr);
+    array->Set(0, AAFwk::String::Box("value").GetRefPtr());
+    args.SetParam("values", array);
+
+    EXPECT_EQ(ToolUtil::ValidateInputSchemaProperties(
+        R"({"properties":{"values":{"type":"array","items":{"type":123}}}})", args), ERR_INVALID_PARAM);
+}
+
 /**
  * @tc.name: ToolUtil_ValidateInputSchemaProperties_1100
  * @tc.desc: Test ValidateInputSchemaProperties with non-empty args and empty schema