GHSA-763v-5pjm-fx36: Strands Agents: Default FileSessionManager storage is world-readable on shared systems

Summary

The default FileSessionManager in Strands Agents (strands-py) writes session data under /tmp/strands/sessions and relies on the process umask for permissions. With the common umask 022, session directories are 0755 and JSON files are 0644, so other local users can read persisted session data such as prompts, model output, tool inputs and outputs, and any secrets that pass through the agent. The issue was reproduced on commit dd7b41de38cb.

Mitigation

Suggested fixes: use a private per-user data directory by default rather than /tmp, or create /tmp/strands and its descendants with 0700; write session JSON atomically with 0600 permissions; consider refusing to use an existing default storage directory that is not owned by the current user or is group or world accessible; and document that callers should set storage_dir explicitly when they need shared storage.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• strands-agentsPyPILLM dependency since 2025-05-14 · 9 tracked dependents