{"id":"ghsa-ghsa-763v-5pjm-fx36","seq":1708795,"kind":"advisory","title":"Strands Agents: Default FileSessionManager storage is world-readable on shared systems","url":"https://github.com/advisories/GHSA-763v-5pjm-fx36","permalink":"https://vulnpulse.app/items/ghsa-ghsa-763v-5pjm-fx36","summary":"影響: pip:strands-agents < 1.48.0 → 1.48.0\nThere is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and JSON files are 0644, so other local users can read persisted agent session data. This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage i…","severity":"medium","techs":["python"],"cves":[],"tags":["GHSA-763v-5pjm-fx36","strands-agents"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:34:28.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}