NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Description

Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake (“Driver”).

Recommendation

Update the snowflake-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.10.0, <= 2.0.3
• Patched version(s): 2.0.4

References

• GHSA-wmjq-jrm2-9wfr
• CVE-2025-46328
• CWE-367
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Snowflake NodeJS Driver vulnerable to Command Injection - CVE-2023-34232
• snowflake-sdk may incorrectly validate temporary credential cache file permissions - CVE-2025-24791
• React Router has Path Traversal in File Session Storage - CVE-2025-61686
• React Router has Path Traversal in File Session Storage - @remix-run/node - CVE-2025-61686

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

Update Cheat Sheet for Developers

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

snowflake-sdk