Snowflake NodeJS Driver vulnerable to Command Injection

Description

Snowflake was informed via our bug bounty program of a command injection vulnerability in the Snowflake NodeJS driver via SSO browser URL authentication.

Recommendation

Update the snowflake-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.21
• Patched version(s): 1.6.21

References

• GHSA-h53w-7qw7-vh5c
• community.snowflake.com
• CVE-2023-34232
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file - CVE-2025-46328
• BrowserStack Local vulnerable to Command Injection through logfile variable - CVE-2025-57283
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes - CVE-2026-31861

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

snowflake-sdk