Snowflakedb vulnerabilities
We track 13 vulnerabilities in Snowflakedb products across 6 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on April 28, 2025.
Latest Snowflakedb vulnerabilities
- 7.0 High severity
snowflake-connector-nodejs: Time-of-check Time-of-use (TOCTOU) Race Condition
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS the Driver reads loggin
- 7.0 High severity
gosnowflake: Time-of-check Time-of-use (TOCTOU) Race Condition
gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration
- 7.0 High severity
snowflake-connector-net: Time-of-check Time-of-use (TOCTOU) Race Condition
snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads log
- 7.8 High severity
snowflake-connector-python: Deserialization of Untrusted Data
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP r
- 7.0 High severity
snowflake-connector-python: Improper Neutralization of Special Elements used in an SQL Command
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function
- 7.8 High severity
snowflake-jdbc: Untrusted Search Path
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is us
- 7.8 High severity
snowflake-hive-metastore-connector: Improper Privilege Management
The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A mal
- 7.5 High severity
snowflake-connector-net: Improper Certificate Validation
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificat
- 8.8 High severity
snowflake-connector-python: Improper Neutralization of Special Elements used in a Command
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL authe
- 8.8 High severity
snowflake-connector-nodejs: Improper Neutralization of Special Elements used in a Command
snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to be
- 8.8 High severity
snowflake-connector-net: Improper Neutralization of Special Elements used in a Command
snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishi
- 8.8 High severity
gosnowflake: Improper Neutralization of Special Elements used in a Command
gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attacke
- 8.8 High severity
snowflake-jdbc: Improper Neutralization of Special Elements used in a Command
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicl