CVE-2025-12397: SQL Injection in Looker Studio
A SQL injection vulnerability was found in Looker Studio.
A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source.
This vulnerability was patched on 21 July 2025, and no customer action is needed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12397?
CVE-2025-12397 has been categorized as a critical severity vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2025-12397?
To mitigate CVE-2025-12397, ensure that all Looker Studio reports using BigQuery are sanitized to prevent malicious SQL injection.
Who is affected by CVE-2025-12397?
CVE-2025-12397 affects users of Looker Studio who have report view access and utilize BigQuery as a data source.
What kind of attack is possible with CVE-2025-12397?
CVE-2025-12397 allows for SQL injection attacks, where an attacker can execute arbitrary SQL code with the report owner's permissions.
Is CVE-2025-12397 being actively exploited?
As of now, there are no public reports indicating active exploitation of CVE-2025-12397, but the potential risk remains high.