Skip to content
AI Sec Watch
HighVulnerability

GHSA-3w55-933p-8pv5: Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-3w55-933p-8pv5
Published
Record updated
View JSON
Affected
  • strands-agents < 1.48.0
Fixed in
1.48.0

Summary

The default FileSessionManager in Strands Agents stores session data in the world-writable /tmp/strands/sessions/ directory. Its write routine (open(path + ".tmp", "w") followed by os.replace()) follows symbolic links, so a local attacker can redirect writes to arbitrary files, such as shell configs or SSH keys, or inject crafted session data that the agent later loads without integrity checks.

Mitigation

The source suggests: use a user-private default directory such as ~/.strands/sessions/ or $XDG_DATA_HOME/strands/sessions/; open files with os.open() using O_NOFOLLOW | O_CREAT | O_WRONLY; use tempfile.mkstemp() for atomic writes; verify directory ownership matches the current user before writing; and add optional HMAC integrity verification on session files.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

Related items