NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Description

Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake (“Driver”).

Recommendation

Update the snowflake-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.10.0, <= 2.0.3
• Patched version(s): 2.0.4

References

• GHSA-wmjq-jrm2-9wfr
• CVE-2025-46328
• CWE-367
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Snowflake NodeJS Driver vulnerable to Command Injection - CVE-2023-34232
• snowflake-sdk may incorrectly validate temporary credential cache file permissions - CVE-2025-24791
• Astro Development Server has Arbitrary Local File Read - CVE-2025-64757
• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428

Tags:

npm

snowflake-sdk