Remote Code Execution Vulnerability in Looker by Google Cloud

CVE-2025-12739

What is CVE-2025-12739?

A vulnerability exists in Looker that allows an attacker with viewer permissions to craft a malicious URL. When an admin opens this URL, the attacker's script executes, posing significant security risks. This vulnerability affects both Looker-hosted and self-hosted deployments. While Looker-hosted instances have been automatically mitigated, self-hosted versions require urgent upgrades. All patched versions of the Looker Self-hosted product include protections against this vulnerability. Users are advised to download the latest supported versions from the Looker download page.

References