CVE-2025-12409
Severity CVSS v4.0:
HIGH
Type:
CWE-89
SQL Injection
Publication date:
10/11/2025
Last modified:
12/11/2025
Description
A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.<br />
<br />
By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim&#39;s permissions in BigQuery.<br />
<br />
This vulnerability was patched on 07 July 2025, and no customer action is needed.