How severe is GHSA-763v-5pjm-fx36?

No CVSS score has been assigned to GHSA-763v-5pjm-fx36 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-763v-5pjm-fx36?

GHSA-763v-5pjm-fx36 affects the following packages: strands-agents (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-763v-5pjm-fx36?

Update strands-agents to 1.48.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-763v-5pjm-fx36 is resolved across your whole dependency graph.

How do I detect GHSA-763v-5pjm-fx36 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for strands-agents, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-763v-5pjm-fx36 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-763v-5pjm-fx36 actively exploited in the wild?

No public exploit code has been indexed for GHSA-763v-5pjm-fx36 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-763v-5pjm-fx36 published, and has it been updated?

GHSA-763v-5pjm-fx36 was published on October 27, 2026 and was last updated on October 27, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

Not in CISA KEV

Strands Agents: Default FileSessionManager storage is world-readable on shared systemsGHSA-763v-5pjm-fx36

Fix: strands-agents/harness-sdk#2937

GHSA-763v-5pjm-fx36 is a security vulnerability in strands-agents. A fix is available for strands-agents — see the affected versions and patch details below.

Published

Oct 27, 2026

Updated

Oct 27, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 27, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍strands-agents

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and JSON files are 0644, so other local users can read persisted agent session data.

This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.

Relevant code:

strands-py/src/strands/session/file_session_manager.py:58: default storage path is os.path.join(tempfile.gettempdir(), "strands/sessions").
strands-py/src/strands/session/file_session_manager.py:118: creates parent directories without a private mode.
strands-py/src/strands/session/file_session_manager.py:121: writes JSON files via normal open(..., "w").
strands-py/src/strands/session/file_session_manager.py:131: creates session directories without a private mode.

Local reproduction with umask 022:

default_storage_dir= /tmp/strands/sessions
0o755 /tmp/strands/sessions
0o755 /tmp/strands/sessions/session_codex_perm_poc
0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json
file_contains_secret= True

The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.

Suggested fixes:

Use a private per-user data directory by default rather than /tmp, or create /tmp/strands and descendants with 0700.
Write session JSON atomically with 0600 permissions.
Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.
Document that callers should set storage_dir explicitly when they need shared storage.

This was reproduced on commit dd7b41de38cb.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`strands-agents`	all versions	1.48.0`pip install --upgrade 'strands-agents==1.48.0'`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for strands-agents, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update strands-agents to 1.48.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-763v-5pjm-fx36 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data. This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output,

O3 Security · Impact-Aware SCA

Is GHSA-763v-5pjm-fx36 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works