GHSA-763v-5pjm-fx36: Jupyter Notebook

Q: Is GHSA-763v-5pjm-fx36 actively exploited?

No confirmed active exploitation of GHSA-763v-5pjm-fx36 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-763v-5pjm-fx36?

1) Upgrade strands-agents to 1.48.0 or later. 2) Until patched, pass an explicit storage_dir located in a per-user directory with mode 0700, and set umask 077 for agent processes. 3) Run chmod -R go-rwx /tmp/strands on existing hosts, or better, delete or move old session data. 4) Rotate secrets and API keys that may have appeared in agent sessions on shared hosts. 5) Detect exposure by searching for files under /tmp/strands/sessions with group or world read permissions and by auditing file-access logs for reads by other users. 6) Use isolated containers or per-user runners for agent workloads on CI and shared servers.

Q: What systems are affected by GHSA-763v-5pjm-fx36?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, session persistence and memory stores, CI/CD agent runners, multi-user shared GPU servers and notebooks.

Q: What is the CVSS score for GHSA-763v-5pjm-fx36?

No CVSS score has been assigned yet.

CISO Take

The strands-agents Python SDK's default FileSessionManager writes agent session data to /tmp/strands/sessions and relies on the process umask, so on typical systems (umask 022) directories end up 0755 and JSON files 0644, readable by any local user. Those files can hold prompts, model output, tool inputs and outputs, and any secrets that pass through the agent, which makes this a real exposure on shared developer machines, CI hosts, jump boxes and multi-user GPU servers. The issue needs local access and is not in CISA KEV, with no public exploit or scanner template and no EPSS score yet, so the likelihood of targeted exploitation is low. The package has about 3,046 downstream dependents, an OpenSSF Scorecard of 5.8/10 and 77 other tracked CVEs, so check where it is deployed on multi-tenant hosts. Upgrade to strands-agents 1.48.0, set an explicit private storage_dir in the meantime, and rotate any credentials that may have passed through sessions stored in the old default location.

Sources:GitHub AdvisoryOpenSSFATLAS

What is the risk?

Medium. Exploitation is trivial but needs local, unprivileged access to the same host. The impact is confidentiality only: session files can expose prompts, tool outputs and secrets. Risk is highest on shared infrastructure such as CI runners, notebooks, jump boxes and multi-user GPU servers, and negligible on single-user or isolated container deployments. There is no known active exploitation (not in KEV, no public exploit, no EPSS data).

How does the attack unfold?

Initial Access

The attacker obtains a low-privileged local account on a shared host, such as a CI runner, notebook server or GPU box where Strands agents run.

AML.T0012

Discovery

The attacker lists /tmp/strands/sessions and finds session directories and JSON files readable by all users.

AML.T0007

Collection

The attacker reads session.json files containing prompts, model output, tool inputs and outputs, and secrets.

AML.T0037

Impact

The attacker reuses the stolen credentials or leaks the confidential data, causing data exposure and possible lateral movement.

AML.T0055

Initial Access

The attacker obtains a low-privileged local account on a shared host, such as a CI runner, notebook server or GPU box where Strands agents run.

AML.T0012

Discovery

The attacker lists /tmp/strands/sessions and finds session directories and JSON files readable by all users.

AML.T0007

Collection

The attacker reads session.json files containing prompts, model output, tool inputs and outputs, and secrets.

AML.T0037

Impact

The attacker reuses the stolen credentials or leaks the confidential data, causing data exposure and possible lateral movement.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	< 1.48.0	`1.48.0`
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade strands-agents to 1.48.0 or later. 2) Until patched, pass an explicit storage_dir located in a per-user directory with mode 0700, and set umask 077 for agent processes. 3) Run chmod -R go-rwx /tmp/strands on existing hosts, or better, delete or move old session data. 4) Rotate secrets and API keys that may have appeared in agent sessions on shared hosts. 5) Detect exposure by searching for files under /tmp/strands/sessions with group or world read permissions and by auditing file-access logs for reads by other users. 6) Use isolated containers or per-user runners for agent workloads on CI and shared servers.

How is it classified?

Data LeakageData ExtractionAgentFrameworkAML.T0036- Data from Information Repositories AML.T0037- Data from Local System AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to and manage identified AI risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is GHSA-763v-5pjm-fx36?

The strands-agents Python SDK's default FileSessionManager writes agent session data to /tmp/strands/sessions and relies on the process umask, so on typical systems (umask 022) directories end up 0755 and JSON files 0644, readable by any local user. Those files can hold prompts, model output, tool inputs and outputs, and any secrets that pass through the agent, which makes this a real exposure on shared developer machines, CI hosts, jump boxes and multi-user GPU servers. The issue needs local access and is not in CISA KEV, with no public exploit or scanner template and no EPSS score yet, so the likelihood of targeted exploitation is low. The package has about 3,046 downstream dependents, an OpenSSF Scorecard of 5.8/10 and 77 other tracked CVEs, so check where it is deployed on multi-tenant hosts. Upgrade to strands-agents 1.48.0, set an explicit private storage_dir in the meantime, and rotate any credentials that may have passed through sessions stored in the old default location.

Is GHSA-763v-5pjm-fx36 actively exploited?

No confirmed active exploitation of GHSA-763v-5pjm-fx36 has been reported, but organizations should still patch proactively.

How to fix GHSA-763v-5pjm-fx36?

1) Upgrade strands-agents to 1.48.0 or later. 2) Until patched, pass an explicit storage_dir located in a per-user directory with mode 0700, and set umask 077 for agent processes. 3) Run chmod -R go-rwx /tmp/strands on existing hosts, or better, delete or move old session data. 4) Rotate secrets and API keys that may have appeared in agent sessions on shared hosts. 5) Detect exposure by searching for files under /tmp/strands/sessions with group or world read permissions and by auditing file-access logs for reads by other users. 6) Use isolated containers or per-user runners for agent workloads on CI and shared servers.

What systems are affected by GHSA-763v-5pjm-fx36?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, session persistence and memory stores, CI/CD agent runners, multi-user shared GPU servers and notebooks.

What is the CVSS score for GHSA-763v-5pjm-fx36?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkssession persistence and memory storesCI/CD agent runnersmulti-user shared GPU servers and notebooks

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0037Data from Local System

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data. This matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent. Relevant code: - `strands-py/src/strands/session/file_session_manager.py:58`: default storage path is `os.path.join(tempfile.gettempdir(), "strands/sessions")`. - `strands-py/src/strands/session/file_session_manager.py:118`: creates parent directories without a private mode. - `strands-py/src/strands/session/file_session_manager.py:121`: writes JSON files via normal `open(..., "w")`. - `strands-py/src/strands/session/file_session_manager.py:131`: creates session directories without a private mode. Local reproduction with `umask 022`: ```text default_storage_dir= /tmp/strands/sessions 0o755 /tmp/strands/sessions 0o755 /tmp/strands/sessions/session_codex_perm_poc 0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json file_contains_secret= True ``` The fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file. Suggested fixes: - Use a private per-user data directory by default rather than `/tmp`, or create `/tmp/strands` and descendants with `0700`. - Write session JSON atomically with `0600` permissions. - Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible. - Document that callers should set `storage_dir` explicitly when they need shared storage. This was reproduced on commit `dd7b41de38cb`.

Exploitation Scenario

On a shared GPU server or CI host, a developer runs a Strands agent with the default session storage. The agent handles customer data and calls tools that use API tokens, and its session JSON lands in /tmp/strands/sessions with 0644 permissions. A second, low-privileged local user, such as a compromised build job or a malicious colleague, lists the directory and reads the session.json files. They harvest prompts, model outputs, tool results and embedded secrets, then use the stolen tokens for lateral movement or data theft.

Weaknesses (CWE)

CWE-276Incorrect Default PermissionsPrimary

CWE-276 — Incorrect Default Permissions: During installation, installed file permissions are set to allow anyone to modify those files.

[Architecture and Design, Operation] The architecture needs to access and modification attributes for files to only those users who actually require those actions.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.