SQL Injection Vulnerability in Looker Studio by Google

CVE-2025-12409

What is CVE-2025-12409?

A SQL injection vulnerability impacting Looker Studio enables attackers to execute unauthorized SQL queries against BigQuery data sources. This can result in data exfiltration when a user accesses a malicious report with native functions activated, allowing the execution of injected queries under the victim's permissions. Google has patched this vulnerability as of July 7, 2025, and no action is needed from customers.

References