GHSA-3w55-933p-8pv5: Strands Agents' default session storage in /tmp could be hijacked with symlinks and read by other local users
The Strands Agents Python SDK's FileSessionManager stored sessions under /tmp/strands/sessions by default, with predictable paths, a write that follows symlinks, and the normal umask. Another user on the same machine could overwrite files the agent process can write, plant session history that the agent reloads as a lasting prompt injection, or simply read saved conversations and secrets. Fixed in strands-agents 1.48.0.
What it is
GHSA-3w55-933p-8pv5: _write_file() writes to a predictable <path>.tmp and then renames it. A local attacker who pre-creates the session directory and puts a symlink at the .tmp path makes the agent write JSON into any file it can write, such as ~/.bashrc or ~/.ssh/authorized_keys.
Session files have no integrity check, so an attacker can also write crafted messages into a session directory; when the app restores the session, the agent follows those instructions on every later turn.
GHSA-763v-5pjm-fx36: with the common umask 022, session directories are 0755 and files 0644, so other local users can read prompts, model output, tool inputs and outputs, and any secrets that passed through the agent.
How to check
- Affected: strands-agents (PyPI) before 1.48.0.
- You are at risk if you use FileSessionManager without setting storage_dir on a machine other people or processes share, such as a CI host, jump box, notebook server or multi-user GPU server.
How to fix
- Upgrade strands-agents to 1.48.0 or later.
- Until then, pass an explicit storage_dir inside a private directory only your user can access (mode 0700).
pip show strands-agents | grep -i version
ls -ld /tmp/strands/sessions 2>/dev/null