PT-2025-45607 · Google · Looker Studio+1

Liv Matan · Published 2025-11-10 · Updated 2025-11-10 · CVE-2025-12409

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Clear

Name of the Vulnerable Software and Affected Versions Looker Studio versions prior to 07 July 2025

Description A SQL injection issue was identified in Looker Studio, potentially allowing unauthorized data exfiltration from BigQuery data sources. An attacker could create a malicious report with native functions enabled. When a victim accesses this report, the attacker could execute injected SQL queries using the victim’s permissions within BigQuery. The API endpoint used for this attack is not specified. The vulnerable parameter is not specified. The function executeSQL() is potentially involved.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-12409

Affected Products

Bigquery

Looker Studio

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12409 · Security Note
• https://t.me/cveNotify/142253 · Telegram Post
• https://twitter.com/CVEnew/status/1987812418550935643 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987817356676989041 · Twitter Post
• https://tenable.com/security/research/tra-2025-27 · Note
• https://cloud.google.com/support/bulletins#gcp-2025-053 · Note
• https://t.me/CVEtracker/36902 · Telegram Post