Live › vulnerability › GHSA-763v-5pjm-fx36
Go to dashboardThe Strands Agents FileSessionManager writes persisted agent sessions to /tmp/strands/sessions using the process umask, so with the common umask 022 the JSON files are world-readable. Other local users on the same machine can read prompts, model output, tool inputs and outputs, and any secrets that pass through the agent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:39 UTC. All times on this page are UTC.
Applications using strands-agents before 1.48.0 that rely on the default FileSessionManager storage path on a multi-user machine. The exposure is local: other accounts on the same host can read the session files. Systems where only one user runs the agent, or where storage_dir is set explicitly to a private location, are not exposed by this default.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| strands-agents | pypi | < 1.48.0 | 1.48.0 |
python -c "import tempfile,os; print(os.path.join(tempfile.gettempdir(),'strands/sessions'))" and then ls -ld /tmp/strands/sessions to see whether the default directory exists and its models -l /tmp/strands/sessions/*/session.json for files with mode -rw-r--r--pip show strands-agents and compare against 1.48.0strands-agents to 1.48.0 or laterstorage_dir on FileSessionManager to a private directory you own when using a shared host/tmp/strands/sessions after upgrading if it may contain secrets, and rotate any secrets that appeared in sessionsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and JSON files are 0644, so other local users can read persisted agent session data.
This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.
Relevant code:
strands-py/src/strands/session/file_session_manager.py:58: default storage path is os.path.join(tempfile.gettempdir(), "strands/sessions").strands-py/src/strands/session/file_session_manager.py:118: creates parent directories without a private mode.strands-py/src/strands/session/file_session_manager.py:121: writes JSON files via normal open(..., "w").strands-py/src/strands/session/file_session_manager.py:131: creates session directories without a private mode.Local reproduction with umask 022:
default_storage_dir= /tmp/strands/sessions
0o755 /tmp/strands/sessions
0o755 /tmp/strands/sessions/session_codex_perm_poc
0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json
file_contains_secret= True
The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.
Suggested fixes:
/tmp, or create /tmp/strands and descendants with 0700.0600 permissions.storage_dir explicitly when they need shared storage.This was reproduced on commit dd7b41de38cb.
This page as .md · .json · in your agent: get_signal("GHSA-763v-5pjm-fx36")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.