CVE-2023-34231 Snowflake Golang Driver vulnerable to Command Injection

What is CVE-2023-34231?

CVE-2023-34231 is a high-severity command injection vulnerability in snowflakedb gosnowflake, published on 8 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. A patch is available in version 1.6.19.

Weakness: CWE-77

Which versions are affected by CVE-2023-34231?

2 open source packages ship an affected version, including github.com/snowflakedb/gosnowflake. It affects 1 product.

Products include Snowflake Gosnowflake.

How do I fix CVE-2023-34231?

Upgrade github.com/snowflakedb/gosnowflake to 1.6.19 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-34231 being exploited?

There is no known exploitation of CVE-2023-34231 in the wild and no public exploit code.

Other vulnerabilities in snowflakedb gosnowflake

• CVE-2025-46327 Go Snowflake Driver has race condition when checking access to Easy Logging configuration file Low 3.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fwv2-65wh-2w8c.