The Strands Agents Python package has two vulnerabilities in its default FileSessionManager: world-readable session storage on shared systems and a symlink attack enabling arbitrary file overwrite and local privilege escalation via predictable temporary file paths.
Disclosed 27 October 2026 · Record updated 27 October 2026
Local attackers on shared systems can read session data containing secrets, prompts, and model outputs, or exploit symlink attacks to overwrite arbitrary files and achieve privilege escalation or persistent prompt injection.
VulnerabilitiesTwo advisories published on 27 October 2026 say the Python SDK's default session storage is world-readable and can be hijacked with a symlink to overwrite arbitrary files.
27 Oct 2026
