GHSA-763v-5pjm-fx36medium5.7

Strands Agents: Default FileSessionManager storage is world-readable on shared systems

The advisory, in context

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and JSON files are 0644, so other local users can read persisted agent session data.

This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.

Relevant code:

strands-py/src/strands/session/file_session_manager.py:58: default storage path is os.path.join(tempfile.gettempdir(), "strands/sessions").
strands-py/src/strands/session/file_session_manager.py:118: creates parent directories without a private mode.
strands-py/src/strands/session/file_session_manager.py:121: writes JSON files via normal open(..., "w").
strands-py/src/strands/session/file_session_manager.py:131: creates session directories without a private mode.

Local reproduction with umask 022:

default_storage_dir= /tmp/strands/sessions
0o755 /tmp/strands/sessions
0o755 /tmp/strands/sessions/session_codex_perm_poc
0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json
file_contains_secret= True

The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.

Suggested fixes:

Use a private per-user data directory by default rather than /tmp, or create /tmp/strands and descendants with 0700.
Write session JSON atomically with 0600 permissions.
Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.
Document that callers should set storage_dir explicitly when they need shared storage.

This was reproduced on commit dd7b41de38cb.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

strands-agents PyPI

Ecosystem versions

Earlier releases before 1.48.0

Fixed in 1.48.0

66 explicitly affected versions

0.0.1, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.3.0, 1.0.0, 1.0.1, 1.1.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1.18.0, 1.19.0, 1.2.0, 1.20.0, 1.21.0, 1.22.0, 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.29.0, 1.3.0, 1.30.0, 1.31.0, 1.32.0, 1.33.0, 1.34.0, 1.34.1, 1.35.0, 1.36.0, 1.37.0, 1.38.0, 1.39.0, 1.4.0, 1.40.0, 1.41.0, 1.42.0, 1.43.0, 1.44.0, 1.45.0, 1.46.0, 1.47.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.48.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.0.1",
    "0.1.0",
    "0.1.1",
    "0.1.2",
    "0.1.3",
    "0.1.4",
    "0.1.5",
    "0.1.6",
    "0.1.7",
    "0.1.8",
    "0.1.9",
    "0.2.0",
    "0.2.1",
    "0.3.0",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.0",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.14.0",
    "1.15.0",
    "1.16.0",
    "1.17.0",
    "1.18.0",
    "1.19.0",
    "1.2.0",
    "1.20.0",
    "1.21.0",
    "1.22.0",
    "1.23.0",
    "1.24.0",
    "1.25.0",
    "1.26.0",
    "1.27.0",
    "1.28.0",
    "1.29.0",
    "1.3.0",
    "1.30.0",
    "1.31.0",
    "1.32.0",
    "1.33.0",
    "1.34.0",
    "1.34.1",
    "1.35.0",
    "1.36.0",
    "1.37.0",
    "1.38.0",
    "1.39.0",
    "1.4.0",
    "1.40.0",
    "1.41.0",
    "1.42.0",
    "1.43.0",
    "1.44.0",
    "1.45.0",
    "1.46.0",
    "1.47.0",
    "1.5.0",
    "1.6.0",
    "1.7.0",
    "1.7.1",
    "1.8.0",
    "1.9.0",
    "1.9.1"
  ]
}

Set up in your agent.

Investigate in your agent.

Strands Agents: Default FileSessionManager storage is world-readable on shared systems

The advisory, in context

Affected packages

References