Vulnerability · Published Jan 29, 2025 · Assigned by GitHub_M
CVE-2025-24791snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions
Medium 4.4
In plain English
A medium-severity security flaw in snowflake-connector-nodejs from snowflakedb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | snowflake-sdk | 2.0.2 | GHSA-xfhv-wqj6-rx99 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| snowflakedb | snowflake-connector-nodejs | >= 1.12.0, < 2.0.2 |
Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N