High severity · published Nov 25, 2025
CVE-2025-12742
Remote Code Execution in Looker via Teradata JDBC Driver
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters.
Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.
Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :
* 24.12.108+
* 24.18.200+
* 25.0.78+
* 25.6.65+
* 25.8.47+
* 25.12.10+
* 25.14+
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Looker · Google Cloud
before 24.12.108; before 24.18.200; before 25.0.78; before 25.6.65; before 25.8.47; before 25.12.10; +8 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12742
cloud.google.com
https://cloud.google.com/support/bulletins#gcp-2025-052
More from Looker
9.2
CVE-2025-12414
Looker account compromise via punycode homograph attack
8.7
CVE-2026-15810
Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
7.7
CVE-2025-12741
Arbitrary File Write in Denodo dialect of Looker allows Remote Code Execution
7.7
CVE-2025-12740
Remote Command Execution in Looker via IBM DB2 JDBC drive
7.3
CVE-2025-12739
Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise