Local Command Execution Vulnerability in Looker by Google

CVE-2025-12740

What is CVE-2025-12740?

In Looker, a flaw exists where users with a Developer role can exploit improperly filtered parameters in the IBM DB2 driver. This allows the execution of unauthorized commands through manipulated LookML scripts. Users of Self-hosted Looker installations are urged to upgrade to the patched versions promptly, while Looker-hosted instances have already received automatic mitigations. Affected Self-hosted versions include those from 25.0.93 upwards to 25.16.44.

References