CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-24791: snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions
4.4
CVSS
Description
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
Classification
CVE ID: CVE-2025-24791
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.4
Affected Products
Vendor: snowflakedb
Product: snowflake-connector-nodejs
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.77% (scored less or equal to compared to others)
EPSS Date: 2025-02-28 (when was this score calculated)
References
https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-xfhv-wqj6-rx99https://github.com/snowflakedb/snowflake-connector-nodejs/commit/89731b3a4d61a75b721d13d4e47a7a3712ffa45f