Skip to content
fr Sign in
7.3 High

CVE-2025-12409 A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data…

Description

A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This vulnerability was patched on 07 July 2025, and no customer action is needed.

Affected products and versions

Product Affected versions Fixed in
Looker Studio 2025 earliest → < 2025-07-07 2025-07-07

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Looker Studio

The 3 CVEs of Looker Studio →
CVE-2025-12405 An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors 7.7 High CVE-2025-12397 A SQL injection vulnerability was found in Looker Studio 7.6 High
Track this CVE