CVE-2025-24793

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

CVE-2025-24795

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential...

CVE-2025-24794

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +106 more potentially affected by CVE-2025-24795 via snowflake-connector-python (>=2.3.7 <=3.13.0)

snowflake-connector-python PYPI version =2.3.7, =2.4.15, =2.4.0, =0.4.0, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =1.0.5, =0.3.1, =1.1.4 - datacontract-cli =0.10.4 and more Source cves: CVE-2025-24795 Source advisory: OSV:PYSEC-2025-28...

GHSA-2MQW-RQ5M-8HC8 Snowflake.Data has weak temporary files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...

Snowflake.Data has weak temporary files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions due to insufficient permission enforcement in DirectoryOperations.cs when writing temporary files downloaded from stages to the OS temporary directory. A user with access to that world-readable directory ca...

snowflake-connector-python vulnerable to SQL Injection in write_pandas

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandastools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1...

SQL Injection

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to SQL Injection in the writepandas function, due to missing sanitization. Note: Only a limited set of query types are not properly parameterized, and any SQL executed by the...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +125 more potentially affected by CVE-2025-24793 via snowflake-connector-python (>=2.2.5 <=3.13.0)

snowflake-connector-python PYPI version =2.2.5, =2.4.15, =2.4.0, =0.0.4, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =0.5.1, =1.0.5, =1.0.6 and more Source cves: CVE-2025-24793 Source advisory: SNYK:PYTHON-SNOWFLAKECONNECTORPYTHON-8674928...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +125 more potentially affected by CVE-2025-24793 via snowflake-connector-python (>=2.2.5 <=3.13.0)

snowflake-connector-python PYPI version =2.2.5, =2.4.15, =2.4.0, =0.0.4, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =0.5.1, =1.0.5, =1.0.6 and more Source cves: CVE-2025-24793 Source advisory: OSV:GHSA-2VPQ-FH52-J3WV...

GHSA-2VPQ-FH52-J3WV snowflake-connector-python vulnerable to SQL Injection in write_pandas

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandastools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1...

Deserialization of Untrusted Data

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the insecure handling of serialization exceptions which is not supported for all exceptions. This is because The OCSP response cache...

snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue...

acedeploy (>=2.4.15 <=2.4.115), arreyy (=0.0.1) +87 more potentially affected by CVE-2025-24794 via snowflake-connector-python (>=2.7.12 <=3.13.0)

snowflake-connector-python PYPI version =2.7.12, =2.4.15, =0.4.0, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =1.0.5, =0.3.1, =1.1.4 - datacontract-cli =0.10.4 - dataligo =0.7.3 and more Source cves: CVE-2025-24794 Source advisory: OSV:GHSA-M4F6-VCJ4-W5MX...

acedeploy (>=2.4.15 <=2.4.115), arreyy (=0.0.1) +87 more potentially affected by CVE-2025-24794 via snowflake-connector-python (>=2.7.12 <=3.13.0)

snowflake-connector-python PYPI version =2.7.12, =2.4.15, =0.4.0, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =1.0.5, =0.3.1, =1.1.4 - datacontract-cli =0.10.4 - dataligo =0.7.3 and more Source cves: CVE-2025-24794 Source advisory: SNYK:PYTHON-SNOWFLAKECONNECTORPYTHON-8674925...

GHSA-M4F6-VCJ4-W5MX snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue...

GHSA-R2X6-CJG7-8R43 snowflake-connector-python vulnerable to insecure cache files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects version...

Incorrect Default Permissions

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Incorrect Default Permissions when using EXTERNALBROWSER or USERNAMEPASSWORDMFA authentication methods with temporary credential caching enabled, allowing the attacker to...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +106 more potentially affected by CVE-2025-24795 via snowflake-connector-python (>=2.3.7 <=3.13.0)

snowflake-connector-python PYPI version =2.3.7, =2.4.15, =2.4.0, =0.4.0, =0.1.3, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =1.0.8, =1.0.5, =0.3.1, =1.1.4 - datacontract-cli =0.10.4 and more Source cves: CVE-2025-24795 Source advisory: OSV:GHSA-R2X6-CJG7-8R43...