# CVE-2025-46328: Snowflake NodeJS Driver race condition in Easy Logging configuration

Source: https://junglewise.ai/threats/cve-2025-46328-snowflake-nodejs-driver-race-condition-in-easy-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-46328 · Severity: low · CVSS 3.1 · Published 2025-04-28

The Snowflake NodeJS Driver for database connectivity includes an Easy Logging feature that reads configuration from a file on Linux and macOS systems. A race condition in the permission-checking logic allows a local attacker to modify the logging configuration file between permission checks, potentially redirecting logs to attacker-controlled locations or changing log verbosity levels to expose sensitive information.

Technologies: [snowflake-sdk (npm)](https://junglewise.ai/threats/technologies/snowflake-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-46328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-46328 being exploited in the wild.

**How severe is CVE-2025-46328?** Low severity, with a CVSS score of 3.1, published 28 April 2025.

**Which products and versions are affected?** snowflake-sdk (npm) SEMVER:introduced=1.10.0,fixed=2.0.4.

**Is there a fix for CVE-2025-46328?** Yes. snowflake-sdk (npm): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-46328 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-46328?** Check whether you run snowflake-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snowflake-sdk (npm): upgrade to 2.0.4 or later

  ```sh
  npm install snowflake-sdk@2.0.4
  ```


## Technical details

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the Easy Logging feature on Linux and macOS. When the driver reads a user-provided logging configuration file, it verifies that only the file owner can write to it; however, this check fails to confirm the file owner matches the user running the driver, and the window between permission verification and actual file use allows an attacker to swap the file. An attacker with local access and write permissions to the configuration file or its directory can exploit this to gain control over logging behavior. The vulnerability affects versions 1.10.0 through 2.0.3; Snowflake patched it in version 2.0.4.

## Affected products

- Snowflake NodeJS Driver 1.10.0 through 2.0.3

## Identifiers

- CVE-2025-46328
- GHSA-wmjq-jrm2-9wfr

## Timeline

- 2025-04-28: disclosed: Vulnerability disclosed via GHSA-wmjq-jrm2-9wfr
- 2025-04-28: patched: Patch released in version 2.0.4

## References

- [https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-wmjq-jrm2-9wfr](https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-wmjq-jrm2-9wfr)

## Related threats

- [Snowflake drivers sensitive information disclosure in logs](https://junglewise.ai/threats/duplicate-advisory-sensitive-information-written-to-logs-by-snowflake-adeece37)
- [Snowflake drivers sensitive information insertion in logs](https://junglewise.ai/threats/cve-2026-86597-snowflake-drivers-sensitive-information-insertion-in-logs)
- [Snowflake snowflake-sdk permission validation bypass in credential cache](https://junglewise.ai/threats/cve-2025-24791-snowflake-snowflake-sdk-permission-validation-bypass-in)
- [Snowflake NodeJS Driver command injection via SSO browser URL](https://junglewise.ai/threats/cve-2023-34232-snowflake-nodejs-driver-command-injection-via-sso-browser-url)