PT-2025-47449
CVE-2025-12472
·
Published
2025-11-19
·
Updated
2025-11-19
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
Name of the Vulnerable Software and Affected Versions
Looker versions prior to 24.12.103
Looker versions prior to 24.18.195
Looker versions prior to 25.0.72
Looker versions prior to 25.6.60
Looker versions prior to 25.8.42
Looker versions prior to 25.10.22
Description
An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, potentially leading to arbitrary command execution on the Looker instance. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances, requiring no user action.
Recommendations
Upgrade to Looker version 24.12.103 or later.
Upgrade to Looker version 24.18.195 or later.
Upgrade to Looker version 25.0.72 or later.
Upgrade to Looker version 25.6.60 or later.
Upgrade to Looker version 25.8.42 or later.
Upgrade to Looker version 25.10.22 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾