# GHSA-763v-5pjm-fx36: Strands Agents: Default FileSessionManager storage is world-readable on shared systems


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 27 Oct 2026

## What is GHSA-763v-5pjm-fx36?

GHSA-763v-5pjm-fx36 is a vulnerability in strands-agents, published on 27 Oct 2026. 

### Official description

There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data.

This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.

Relevant code:
- `strands-py/src/strands/session/file_session_manager.py:58`: default storage path is `os.path.join(tempfile.gettempdir(), "strands/sessions")`.
- `strands-py/src/strands/session/file_session_manager.py:118`: creates parent directories without a private mode.
- `strands-py/src/strands/session/file_session_manager.py:121`: writes JSON files via normal `open(..., "w")`.
- `strands-py/src/strands/session/file_session_manager.py:131`: creates session directories without a private mode.

Local reproduction with `umask 022`:

```text
default_storage_dir= /tmp/strands/sessions
0o755 /tmp/strands/sessions
0o755 /tmp/strands/sessions/session_codex_perm_poc
0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json
file_contains_secret= True
```

The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.

Suggested fixes:
- Use a private per-user data directory by default rather than `/tmp`, or create `/tmp/strands` and descendants with `0700`.
- Write session JSON atomically with `0600` permissions.
- Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.
- Document that callers should set `storage_dir` explicitly when they need shared storage.

This was reproduced on commit `dd7b41de38cb`.

## Which versions are affected by GHSA-763v-5pjm-fx36?

2 open source packages ship an affected version, including strands-agents.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `strands-agents` | PyPI | All versions | 1.48.0 |
| `strands-agents` | PyPI | All versions | 1.48.0 |

## How do I fix GHSA-763v-5pjm-fx36?

Upgrade strands-agents to 1.48.0 or later.

## Is GHSA-763v-5pjm-fx36 being exploited?

There is no known exploitation of GHSA-763v-5pjm-fx36 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-763v-5pjm-fx36 and fix it if it is affected.

What it is: GHSA-763v-5pjm-fx36 is a vulnerability in strands-agents, published on 27 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-763v-5pjm-fx36 in the wild and no public exploit code.

Affected packages and fixed versions:
- strands-agents (PyPI): affected all versions; fixed in 1.48.0
- strands-agents (PyPI): affected all versions; fixed in 1.48.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-763v-5pjm-fx36/ (Markdown: https://insights.sbomify.com/GHSA-763v-5pjm-fx36/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-763v-5pjm-fx36

---
From sbomify Insights: https://insights.sbomify.com/GHSA-763v-5pjm-fx36/
Summaries are generated and may contain mistakes; the official description above is the record.