Looker Command Injection Vulnerability via Improper File Path Sanitization
Vulnerability
A command injection vulnerability has been identified in Looker, both in Looker-hosted and self-hosted instances. This vulnerability arises from improper file path sanitization, allowing an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. While Looker-hosted instances have been mitigated, self-hosted instances must be upgraded as soon as possible. The vulnerability has been patched in all supported versions of self-hosted Looker.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the host system.
Remediation
Self-hosted Looker instances should be upgraded to version 24.12.100+, 24.18.192+, 25.0.69+, 25.6.57+, 25.8.39+ or 25.10.22. Instructions for downloading these versions are available on the Looker download page.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.