CVE-2025-24791mediumCWE-281

CVE-2025-24791: medium-severity vulnerability in snowflakedb snowflake-connector-nodejs

snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

Published

Follow this CVE+ Monitor snowflake-connector-nodejs+ Monitor snowflake-sdk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.1%
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
snowflakedb · snowflake-connector-nodejs
Related CVEs — snowflakedb snowflake-connector-nodejs

In the same product, most dangerous first.

CVE-2023-34232HIGHSnowflake NodeJS Driver vulnerable to Command InjectionEPSS 1.9%CVE-2025-46328LOWNodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration fileEPSS 0.2%