Zero Radar
← feed
HighVulnerabilityGHSA-3w55-933p-8pv5updated 27 Oct 2026, 15:35 UTC

Strands Agents session files can be hijacked by local users via shared temp folder

On a shared computer, another user could tamper with the saved chat history of the AI agent, or overwrite files that belong to you. Updating the package closes this gap.

Fixed in strands-agents 1.48.0Official source
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesstrands-agents 1.48.0 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Shared temp folderDefault session path is world-writable /tmp
  2. 2Plant symlinkAttacker predicts the .tmp file name
  3. 3App writes sessionWrite follows the symlink to a target file
  4. 4Overwrite or injectTarget file changed or history poisoned
  5. ResultAttacker alters files or controls agent behavior

What happened

The FileSessionManager stores session data in the world-writable /tmp/strands/sessions/ directory using predictable file names, and its write method follows symbolic links, allowing arbitrary file overwrite and injection of malicious session data.

Why it is dangerous: A local attacker can overwrite files the victim can write to, such as shell configuration or SSH keys, or inject crafted conversation history that makes the agent follow attacker instructions in future sessions.

Are you affected?

You are affected if you use the strands-agents Python package older than 1.48.0 with the default FileSessionManager storage location on a system where other local users or processes can access /tmp.

Package / productAffected versionsFixed in
strands-agents · pip< 1.48.01.48.0

What to do

  1. Update strands-agents to version 1.48.0 or later (pip install --upgrade strands-agents)
  2. If you cannot update yet, set a custom session storage directory that only your user can access instead of the default /tmp location
  3. Check /tmp/strands/sessions/ for files or symlinks you did not create and remove them

Timeline

  1. 27 Oct 2026, 15:34 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:34 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:35 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-3w55-933p-8pv5
CVSS
7.1 / 10
Disclosed
27 Oct 2026, 15:34 UTC
On Zero Radar
27 Oct 2026, 15:35 UTC (1 min after disclosure)
Last change
27 Oct 2026, 15:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Strands Agents session files can be hijacked by local users via shared temp folder · Zero Radar