strands-agents vulnerabilities
CVEs whose affected-version data names the strands-agents package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
▾ Sunlitstrands-agents · strands-agentsvia OSV
GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
▾ Twilightstrands-agents · strands-agentsvia OSV
CVE-2026-115419High· 8.1Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
▾ Twilightstrands-agents · strands-agentsEPSS 0.43%via OSV