CVE-2025-12472: Looker 0 to before 24.12.103, 0 to before 24.18.195, 0 to before 25.0.72, 0 to before 25.6.60, 0 to before 25.8.42, 0…

Affected technology

Looker · 0 to before 24.12.103, 0 to before 24.18.195, 0 to before 25.0.72, 0 to before 25.6.60, 0 to before 25.8.42, 0 to before 25.10.22
Google Cloud

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · Active user interaction

What an attacker can do

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality, integrity and availability impact as high.