Looker Race Condition Vulnerability in Git Directory Deletion Leading to Arbitrary Command Execution

A race condition vulnerability has been identified in Looker that allows an attacker with a Developer role to manipulate a LookML project. This exploitation occurs during the deletion of Git directories, potentially leading to arbitrary command execution on the affected Looker instance. Both Looker-hosted and self-hosted versions were found to be vulnerable, although the issue has been mitigated for Looker-hosted instances. Self-hosted users must upgrade to a patched version as soon as possible.

Impact

Exploitation of this vulnerability could result in unauthorized arbitrary command execution on the Looker instance.

Remediation

Self-hosted Looker instances should be upgraded to version 24.12.103+, 24.18.195+, 25.0.72+, 25.6.60+, 25.8.42+ or 25.10.22. Instructions for downloading these versions are available on the Looker download page.