Command Injection Vulnerability in Looker by Google Cloud

CVE-2025-12155

What is CVE-2025-12155?

A security vulnerability in Looker arises from improper file path sanitization, specifically allowing command injection. This issue permits an attacker with Developer permissions to execute arbitrary shell commands when a deletion operation is performed by a user on the host system. While Looker-hosted instances have been patched, users of Self-hosted versions must upgrade to the latest versions to protect against potential exploitation. The vulnerability is now resolved in all supported Self-hosted releases.

References