Strands FileSessionManager symlink and file integrity advisory

Evidence record

Strands FileSessionManager advisory for world-writable default session storage and predictable symlink-following temporary files, potentially altering files and replayed memory; patched in 1.48.0.

Read the original source ↗

Claim-level citations (3)

• supportsStrands session file storage exposed local symlink and resumed-memory poisoning paths: The Strands security advisory identifies a symlink attack against default FileSessionManager storage leading to unintended file modification under the agent process permissions.

  Advisory; symlink threat model and affected storage

• supportsStrands session file storage exposed local symlink and resumed-memory poisoning paths: The report also notes that a forged saved session could influence an agent resumed from that state; this requires a writable local path and does not imply remote prompt injection by any chat user.

  Advisory; session tampering implications

• supportsStrands session file storage exposed local symlink and resumed-memory poisoning paths: The advisory says FileSessionManager placed predictable temporary files under /tmp/strands/sessions/ and followed pre-placed symlinks; the fixed version is strands-agents 1.48.0.

  Root Cause and Patched versions, GHSA-3w55-933p-8pv5