CVE-2025-24791: snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-29 · updated 2026-06-17
Weakness: CWE-281

Description

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.

Affected products

snowflakedb snowflake-connector-python: from 1.12.0 before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: snowflakedb snowflake-connector-python 2.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-24791 or the next vulnerability affects your stack