Skip to content
OpenAdvisories

Package · PyPI

strands-agents

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    GHSA-3w55-933p-8pv5

    Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

    ## Summary The `FileSessionManager` defaults to storing session data in `/tmp/strands/sessions/` (a world-writable directory) using predictable file paths and a write pattern (`open(path + ".tmp", "w")` → `os.replace()`) that follows symbolic links. A local a…

    strands-agents PyPI
  • High 8.1
    CVE-2026-115419

    Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

    The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conve…

    AWS strands-agents/sdk strands-agents strands-agents npm PyPI