SQL Injection Vulnerability in Looker's Project Generation Feature

CVE-2025-12743

What is CVE-2025-12743?

The vulnerability in Looker's project generation feature allows users to exploit the schemas parameter by using the reserved connection name 'looker'. This scenario facilitates SQL injection, enabling users with developer permissions to execute unauthorized queries against Looker's internal MySQL database. Although Looker-hosted instances have been mitigated automatically, users with self-hosted instances must upgrade to the latest versions for the necessary security improvements. Available patched versions can be found on the Looker download page.

References