CVE-2025-12472

Summary

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance.

Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these.

Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :

  • 24.12.103+
  • 24.18.195+
  • 25.0.72+
  • 25.6.60+
  • 25.8.42+
  • 25.10.22+

Affected Software

VendorProductVersion RangeStatus
Google CloudLooker0 < 24.12.103affected
Google CloudLooker0 < 24.18.195affected
Google CloudLooker0 < 25.0.72affected
Google CloudLooker0 < 25.6.60affected
Google CloudLooker0 < 25.8.42affected
Google CloudLooker0 < 25.10.22affected
Google CloudLooker0 < 24.12.103affected
Google CloudLooker0 < 24.18.195affected
Google CloudLooker0 < 25.0.72affected
Google CloudLooker0 < 25.6.60affected
Google CloudLooker0 < 25.8.42affected
Google CloudLooker0 < 25.10.22affected

Weaknesses

  • CWE-362: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References