Is CVE-2025-46328 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-46328 being exploited in the wild.

How severe is CVE-2025-46328?

Low severity, with a CVSS score of 3.1, published 28 April 2025.

Which products and versions are affected?

snowflake-sdk (npm) SEMVER:introduced=1.10.0,fixed=2.0.4.

Is there a fix for CVE-2025-46328?

Yes. snowflake-sdk (npm): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-46328 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-46328?

Check whether you run snowflake-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-46328: Snowflake NodeJS Driver race condition in Easy Logging configuration

CVE-2025-46328 · Severity: low · CVSS 3.1 · Published 2025-04-28

The Snowflake NodeJS Driver for database connectivity includes an Easy Logging feature that reads configuration from a file on Linux and macOS systems. A race condition in the permission-checking logic allows a local attacker to modify the logging configuration file between permission checks, potentially redirecting logs to attacker-controlled locations or changing log verbosity levels to expose sensitive information.

Technologies: snowflake-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2025-46328 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-46328 being exploited in the wild.
How severe is CVE-2025-46328?: Low severity, with a CVSS score of 3.1, published 28 April 2025.
Which products and versions are affected?: snowflake-sdk (npm) SEMVER:introduced=1.10.0,fixed=2.0.4.
Is there a fix for CVE-2025-46328?: Yes. snowflake-sdk (npm): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-46328 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-46328?: Check whether you run snowflake-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snowflake-sdk (npm): upgrade to 2.0.4 or later
```
npm install snowflake-sdk@2.0.4
```

Technical details

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the Easy Logging feature on Linux and macOS. When the driver reads a user-provided logging configuration file, it verifies that only the file owner can write to it; however, this check fails to confirm the file owner matches the user running the driver, and the window between permission verification and actual file use allows an attacker to swap the file. An attacker with local access and write permissions to the configuration file or its directory can exploit this to gain control over logging behavior. The vulnerability affects versions 1.10.0 through 2.0.3; Snowflake patched it in version 2.0.4.

Affected products

Snowflake NodeJS Driver 1.10.0 through 2.0.3

Identifiers

CVE-2025-46328
GHSA-wmjq-jrm2-9wfr

Timeline

2025-04-28: disclosed: Vulnerability disclosed via GHSA-wmjq-jrm2-9wfr
2025-04-28: patched: Patch released in version 2.0.4

References

https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-wmjq-jrm2-9wfr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.