Read the docs

Snowflake

Records56All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high27CVSS 7.0–8.9

Exploited now

Snowflake records in CISA KEV

No Snowflake vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Snowflake Connector 13 records HIGH Snowflake Cli 7 records MEDIUM Snowflake Jdbc 6 records MEDIUM Streamlit 5 records MEDIUM Connector For C/c++ 2 records LOW Gosnowflake 2 records MEDIUM T3blog 2 records LOW Snowflake Hive Metastore Connector 1 record LOW

Records

13 records in Snowflake Connector · all components

TI-2022-20945 CVE-2022-42965 · GHSA-4r6j-fwcx-94cf

Exponential ReDoS in snowflake-connector-python leads to denial of service

Priority HIGH 66

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type m…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00956 Published 2022-11-09 Fixed in 2.8.2 CWE-1333
TI-2023-17069 CVE-2023-34233 · GHSA-5w5m-pfw9-c8fp

Snowflake Python Connector vulnerable to Command Injection

Priority MEDIUM 44

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01841 Published 2023-06-08 Fixed in 3.0.2 CWE-77
TI-2023-17068 CVE-2023-34232 · GHSA-h53w-7qw7-vh5c

Snowflake NodeJS Driver vulnerable to Command Injection

Priority MEDIUM 44

snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01897 Published 2023-06-08 Fixed in 1.6.21 CWE-77
TI-2023-17066 CVE-2023-34230 · GHSA-223g-8w3x-98wr

Snowflake Connector vulnerable to Command Injection

Priority MEDIUM 43

snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01431 Published 2023-06-08 Fixed in 2.0.18 CWE-77
TI-2025-18510 CVE-2025-24793 · GHSA-2vpq-fh52-j3wv

Snowflake Connector for Python has an SQL Injection in write_pandas

Priority LOW 33

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00307 Published 2025-01-29 Fixed in 3.13.1 CWE-89
TI-2025-18512 CVE-2025-24795 · GHSA-r2x6-cjg7-8r43

The Snowflake Connector for Python uses insecure cache files permissions

Priority LOW 24

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00139 Published 2025-01-29 Fixed in 3.13.1 CWE-276
TI-2024-33218 CVE-2024-49750 · GHSA-5vvg-pvhp-hv2m

Snowflake Connector for Python has sensitive data in logs

Priority LOW 24

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00202 Published 2024-10-24 Fixed in 3.12.3 CWE-532
Open these records in search →