CVE-2025-12741

Vulnerability

Overview A Looker user with the Developer role can exploit a flaw in the Denodo database driver integration. By crafting a specially manipulated LookML model, the attacker can cause Looker to execute arbitrary commands on the underlying server. This stems from insufficient sanitization of inputs passed to the Denodo driver, allowing injection of malicious system commands during connection setup.

Attack

Vector Exploitation requires an authenticated Looker user who holds the Developer role. The attacker creates a new database connection using the Denodo driver, then manipulates LookML parameters to inject arbitrary system commands. No additional privileges or network position beyond access to the Looker instance are needed. Both Looker-hosted and Self-hosted environments are affected [1].

Impact

Successful exploitation enables remote code execution on the server hosting Looker. An attacker could gain full control over the Looker instance, potentially leading to data exfiltration, lateral movement, or further compromise of connected systems. The vulnerability is rated High severity due to the low complexity and high potential impact.

Mitigation

Looker-hosted instances have already been patched automatically, requiring no user action. Self-hosted instances must upgrade to patched versions: 24.12.108+, 24.18.200+, 25.0.78+, 25.6.65+, 25.8.47+, 25.12.10+, and 25.14+. No workaround is available; upgrading is essential to remediate the vulnerability [1].