Vulnerabilities

Security incident · GHSA-3w55-933p-8pv5

Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · Strands Agents: Local Privilege

Last checked Oct 28, 2026, 11 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-3w55-933p-8pv5. A missing EPSS score is not a low risk. Compare Strands Agents: Local Privilege with the linked advisory before you change production.

Severity

High7.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

pip strands-agents

## Summary The defaults to storing session data in (a world-writable directory) using predictable file paths and a write pattern ( → ) that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or inject malicious session data for persistent prompt injection. ## Vulnerability Details **Component:** **Root Cause:** 1. Default storage directory is (line 58) — resolves to on Linux/macOS 2. The method (lines 116-123) writes to a predictable path without symlink protection: 3. follows symlinks — a pre-placed symlink at the path causes writes to an arbitrary target file 4. No integrity verification (HMAC/signature) on session files — tampered data is loaded as-is ## Attack Vectors ### 1. Arbitrary File Overwrite (Local Privilege Escalation) 1. Attacker pre-creates (or monitors for new directories via inotify) 2. Attacker creates a symlink: → (or any writable file) 3. Victim application writes session data → follows symlink → overwrites target file with JSON content 4. Attacker achieves code execution on next shell login (or targets , cron files, etc.) ### 2. Persistent Prompt Injection via Session Tampering 1. Attacker writes crafted message files into the session directory 2. Victim application restores the session → loads attacker-controlled conversation history 3. Injected messages instruct the agent to execute attacker commands on every future interaction 4. No integrity check prevents this — the SDK trusts all session files at face value ## Impact - **Arbitrary file overwrite** — local attacker can write attacker-controlled content to any file writable by the victim process - **Local privilege escalation** — via overwriting shell configs, SSH keys, cron jobs, or systemd user services - **Persistent agent compromise** — via session data injection, the agent follows attacker instructions indefinitely ## Reproduction ## Suggested Fix 1. **Use a user-private default directory** — or instead of 2. **Use with ** — refuses to follow symlinks