Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2025-12409: BigQuery Data Theft Possible through Malicious Looker Studio Reports
CVE-2025-12409 · published 11 months ago
Summary
Looker Studio, a tool that connects to BigQuery, had a flaw that let hackers steal data from BigQuery sources. This issue is now fixed, but it's a reminder to be cautious when sharing reports. No action is required from customers.
Original advisory text
A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.
By creating a malicious report with native functions enabled, and havi...
A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.
By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.
This vulnerability was patched on 07 July 2025, and no customer action is needed.
By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.
This vulnerability was patched on 07 July 2025, and no customer action is needed.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published10 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-12409 · NVD
Track software like this
Free during beta