CVE-2025-12397
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Risk Assessment
An attacker could execute unauthorized SQL queries with the report owner's permissions, potentially leading to data leakage or unauthorized access to data in BigQuery.
Recommendation
No action is required as the vulnerability has already been patched. Ensure you are using the latest version of Looker Studio.
Other vulnerabilities in Looker Studio
See all- CVE-2025-12405High
An improper privilege management vulnerability in Looker Studio affects all JDBC-based connectors. A user with report view access could copy the report and execute arbitrary SQL on the data source database using stored credentials. This was patched on 21 July 2025, no customer action is needed.
- CVE-2025-12409High
A SQL injection vulnerability in Looker Studio allowed data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled and having the victim access it, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This was patched on 07 July 2025, no customer action is needed.
Original NVD description (English source)
A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS