CVE-2025-46328 NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided...

GHSA-WMJQ-JRM2-9WFR NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake “Driver”. When using the Easy Logging feature on Linux and macOS the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to...

CVE-2024-8055 Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna

Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the PUT and COPY commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as /etc/passwd, by exploiting the exposed SQL queries...

@abaplint/database-snowflake (>=2.7.93 <=2.7.101), @activeboxes/piece-snowflake (=0.0.10) +172 more potentially affected by CVE-2025-24791 via snowflake-sdk (>=1.13.1 <=1.9.3)

snowflake-sdk NPM version =1.13.1, =2.7.93, =0.0.1, =0.0.19, =0.0.5, =8.0.0, =1.8.0, =0.0.0, =0.4.4, =0.7.17, =1.0.0, =0.0.2, =1.0.2, =1.0.3 and more Source cves: CVE-2025-24791 Source advisory: OSV:GHSA-XFHV-WQJ6-RX99...

Incorrect Security Setting

net.snowflake, snowflake-jdbc is vulnerable to an Incorrect Security Setting. The vulnerability is due to data being uploaded to an encrypted stage without client-side encryption, allowing unauthorized parties to access or modify sensitive information...

LAUSD Data Breach: Hackers Leak 25M Records, Including Student Locations

The Los Angeles Unified School District LAUSD suffered a massive data breach due to a Snowflake vulnerability, exposing personal details of millions of students and thousands of teachers and staff...