CVE-2025-12409
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A SQL injection vulnerability in Looker Studio allowed data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled and having the victim access it, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This was patched on 07 July 2025, no customer action is needed.
Risk Assessment
The risk includes unauthorized access to BigQuery data and the possibility of exfiltration. An attacker could steal sensitive organizational data using the victim's permissions.
Recommendation
No customer action is needed as the patch has already been deployed. However, it is recommended to monitor BigQuery access and verify if any unauthorized queries have occurred.
Other vulnerabilities in Looker Studio
See all- CVE-2025-12405High
An improper privilege management vulnerability in Looker Studio affects all JDBC-based connectors. A user with report view access could copy the report and execute arbitrary SQL on the data source database using stored credentials. This was patched on 21 July 2025, no customer action is needed.
- CVE-2025-12397High
A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Original NVD description (English source)
A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This vulnerability was patched on 07 July 2025, and no customer action is needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS