# CVE-2025-24791: snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

> CVE-2025-24791: snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions. CVSS 4.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-24791
Last updated: 2026-06-17T08:59:36Z

- Published: 2025-01-29 16:59 UTC · Updated: 2026-06-17 08:59 UTC · Assigner: GitHub\_M
- CVSS: 4.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS: 0.15%, 4th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-281

## Description

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.

## Affected vendors and products

- snowflakedb: snowflake-connector-nodejs

## Tracked companies

- [Snowflake](https://rewindex.com/company/snowflake.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-24791)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-24791)
- [https://github.com/snowflakedb/snowflake-connector-nodejs/commit/89731b3a4d61a75b721d13d4e47a7a3712ffa45f](https://github.com/snowflakedb/snowflake-connector-nodejs/commit/89731b3a4d61a75b721d13d4e47a7a3712ffa45f)
- [https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-xfhv-wqj6-rx99](https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-xfhv-wqj6-rx99)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-24791 · Markdown: https://rewindex.com/cve/CVE-2025-24791.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-24791 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:39.104Z