{"answers":{"affected":"2 open source packages ship an affected version, including strands-agents.","exploited":"There is no known exploitation of GHSA-763v-5pjm-fx36 in the wild and no public exploit code.","fix":"Upgrade strands-agents to 1.48.0 or later.","what":"GHSA-763v-5pjm-fx36 is a vulnerability in strands-agents, published on 27 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-763v-5pjm-fx36 and fix it if it is affected.\n\nWhat it is: GHSA-763v-5pjm-fx36 is a vulnerability in strands-agents, published on 27 Oct 2026. \nExploitation: There is no known exploitation of GHSA-763v-5pjm-fx36 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- strands-agents (PyPI): affected all versions; fixed in 1.48.0\n- strands-agents (PyPI): affected all versions; fixed in 1.48.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-763v-5pjm-fx36/ (Markdown: https://insights.sbomify.com/GHSA-763v-5pjm-fx36/index.md)","id":"GHSA-763v-5pjm-fx36","markdown":"https://insights.sbomify.com/GHSA-763v-5pjm-fx36/index.md","name":"GHSA-763v-5pjm-fx36","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data.\n\nThis matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.\n\nRelevant code:\n- `strands-py/src/strands/session/file_session_manager.py:58`: default storage path is `os.path.join(tempfile.gettempdir(), \"strands/sessions\")`.\n- `strands-py/src/strands/session/file_session_manager.py:118`: creates parent directories without a private mode.\n- `strands-py/src/strands/session/file_session_manager.py:121`: writes JSON files via normal `open(..., \"w\")`.\n- `strands-py/src/strands/session/file_session_manager.py:131`: creates session directories without a private mode.\n\nLocal reproduction with `umask 022`:\n\n```text\ndefault_storage_dir= /tmp/strands/sessions\n0o755 /tmp/strands/sessions\n0o755 /tmp/strands/sessions/session_codex_perm_poc\n0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json\nfile_contains_secret= True\n```\n\nThe fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.\n\nSuggested fixes:\n- Use a private per-user data directory by default rather than `/tmp`, or create `/tmp/strands` and descendants with `0700`.\n- Write session JSON atomically with `0600` permissions.\n- Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.\n- Document that callers should set `storage_dir` explicitly when they need shared storage.\n\nThis was reproduced on commit `dd7b41de38cb`.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Strands Agents: Default FileSessionManager storage is world-readable on shared systems","id":"GHSA-763v-5pjm-fx36","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["1.48.0"],"introduced":["0"],"last_affected":[],"package":"strands-agents","purl":null,"source":"GHSA-763v-5pjm-fx36"},{"ecosystem":"PyPI","fixed":["1.48.0"],"introduced":["0"],"last_affected":[],"package":"strands-agents","purl":"pkg:pypi/strands-agents","source":"GHSA-763v-5pjm-fx36"}],"products":null,"published":"2026-10-27","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-763v-5pjm-fx36/"}