NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Description

Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake (“Driver”).

Recommendation

Update the snowflake-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.10.0, <= 2.0.3
• Patched version(s): 2.0.4

References

• GHSA-wmjq-jrm2-9wfr
• CVE-2025-46328
• CWE-367
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Snowflake NodeJS Driver vulnerable to Command Injection - CVE-2023-34232
• snowflake-sdk may incorrectly validate temporary credential cache file permissions - CVE-2025-24791
• Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups (GHSA-968p-4wvh-cqc8) 2 - CVE-2025-27789
• Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups (GHSA-968p-4wvh-cqc8) - CVE-2025-27789

Tags:

npm

snowflake-sdk