GHSA-763v-5pjm-fx36: Pip/strands-agents vulnerability
There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and JSON files are 0644, so other local users can read persisted agent session data.
This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.
Relevant code: - strands-py/src/strands/session/filesessionmanager.py:58: default storage path is os.path.join(tempfile.gettempdir(), "strands/sessions"). - strands-py/src/strands/session/filesessionmanager.py:118: creates parent directories without a private mode. - strands-py/src/strands/session/filesessionmanager.py:121: writes JSON files via normal open(..., "w"). - strands-py/src/strands/session/filesessionmanager.py:131: creates session directories without a private mode.
Local reproduction with umask 022:
text defaultstoragedir= /tmp/strands/sessions 0o755 /tmp/strands/sessions 0o755 /tmp/strands/sessions/sessioncodexpermpoc 0o644 /tmp/strands/sessions/sessioncodexpermpoc/session.json filecontainssecret= True
The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.
Suggested fixes: - Use a private per-user data directory by default rather than /tmp, or create /tmp/strands and descendants with 0700. - Write session JSON atomically with 0600 permissions. - Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible. - Document that callers should set storagedir explicitly when they need shared storage.
This was reproduced on commit dd7b41de38cb.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/strands-agentsto a version that resolves this vulnerability.Fixed in 1.48.0 - Configuration
Use a private per-user data directory by default instead of /tmp, or create /tmp/strands and all descendant session directories with 0700 permissions.
FileSessionManager default storage directory = private per-user data directory, or /tmp/strands and descendants with 0700 permissions - Configuration
Write session JSON files atomically with 0600 permissions.
FileSessionManager session JSON file permissions = 0600 - Configuration
Refuse to use an existing default storage directory if it is not owned by the current user or is group/world accessible.
FileSessionManager default storage directory validation = refuse directories not owned by the current user or accessible by group/world
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems where multiple local users can access the same host are exposed when FileSessionManager uses its default storage location and the process uses a permissive umask such as 022. Examples identified include shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers.
What access does an attacker need?
An attacker needs local access to the host as another user who can read world-readable files and traverse the session directories. No remote access scenario is described.
Is the default configuration affected?
Yes. The default FileSessionManager path is /tmp/strands/sessions, and with a common umask of 022 its directories are created with mode 0755 and its JSON session files with mode 0644.
How can I determine whether existing session data may be exposed?
Inspect the permissions of directories below /tmp/strands/sessions and the JSON files within them. Under umask 022, directories with mode 0755 and files with mode 0644 can be read by other local users.
What information could be disclosed?
Persisted session data can include prompts, model outputs, tool inputs and outputs, intermediate state, and secrets that pass through the agent.