High severity · published Nov 24, 2025
CVE-2025-12740
Remote Command Execution in Looker via IBM DB2 JDBC drive
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 25.0.93+
* 25.6.84+
* 25.12.42+
* 25.14.50+
* 25.16.44+
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Looker · Google Cloud
before 25.0.93; before 25.6.84; before 25.12.42; before 25.14.50; before 25.16.44; before 25.0.93; +4 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12740
cloud.google.com
https://cloud.google.com/support/bulletins#gcp-2025-052
More from Looker
9.2
CVE-2025-12414
Looker account compromise via punycode homograph attack
8.7
CVE-2026-15810
Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
7.7
CVE-2025-12741
Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
7.5
CVE-2025-12742
Remote Code Execution in Looker via Teradata JDBC Driver
7.3
CVE-2025-12739
Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise