Read the docs
TI-2025-11679 Aliases CVE-2025-12743GHSA-8fvv-8rcf-99j8

SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database

Priority LOW 27CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries that are constructed and executed against the internal MySQL database. This vulnerability allows users with developer permissions to extract data from Looker's internal MySQL database. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect against this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.106 * 24.18.198+ * 25.0.75 * 25.6.63+ * 25.8.45+ * 25.10.33+ * 25.12.1+ * 25.14+

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Fix Fixed Looker (Google Cloud): 24.12.106, 24.18.198, 25.0.75 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleLookerbefore 24.12.106; before 24.18.198; before 25.0.75; before 25.6.63; before 25.8.45; before 25.10.33; before 25.12.1; before 25.1424.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14Patch availableCNA
GoogleLookerbefore 24.12.106; before 24.18.198; before 25.0.75; before 25.6.63; before 25.8.45; before 25.10.33; before 25.12.1; before 25.1424.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14Patch availableCNA
  • Looker VendorGoogle Affected before 24.12.106; before 24.18.198; before 25.0.75; before 25.6.63; before 25.8.45; before 25.10.33; before 25.12.1; before 25.14 Fixed in 24.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14 Patch available CNA
  • Looker VendorGoogle Affected before 24.12.106; before 24.18.198; before 25.0.75; before 25.6.63; before 25.8.45; before 25.10.33; before 25.12.1; before 25.14 Fixed in 24.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14 Patch available CNA

Remediation

  • Fix · CNA Looker (Google Cloud) Fixed in 24.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14
  • Fix · CNA Looker (Google Cloud) Fixed in 24.12.106, 24.18.198, 25.0.75, 25.6.63, 25.8.45, 25.10.33, 25.12.1, 25.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12743
  2. 2026-10-03 Alias added: GHSA-8fvv-8rcf-99j8

References

Other 2

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences