CVE-2025-12743

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT...

CVE-2025-12739

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This...

CVE-2025-12472

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

CVE-2025-12742

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required...

CVE-2025-12414

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgrad...

CVE-2025-12741

A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user...

CVE-2025-12740

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has...

CVE-2025-12742

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required...

CVE-2025-12742 Remote Code Execution in Looker via Teradata JDBC Driver

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required...

CVE-2025-12742 Remote Code Execution in Looker via Teradata JDBC Driver

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required...

Malicious code in @voiceflow/fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae935a1a5c4c3792b0a6e51cfeca10ee5d11192e0928bf28ac3fd58ce89c24b7 The package @voiceflow/fetch was found to contain malicious code. Source: ghsa-malware 18354d00f52198c519ac2adf8360486ea1817d9cd1e577fe147eaff0d7633f...

Malicious code in @voiceflow/api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3e961a08f55ee9c09ea08f6e26ed609d489927fd347b2015b8c7a3074f6c439 The package @voiceflow/api-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191185 Malicious code in @alexcolls/nuxt-socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dee0cebdac319dea5d5f8c78c0d15431297789499f8e486729175fffb7c4f91 The package @alexcolls/nuxt-socket.io was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191382 Malicious code in @voiceflow/verror (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b5a50b0295fd87094117e38841e99bba0c11d47626ee9ced19ea9e7547d08e The package @voiceflow/verror was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191403 Malicious code in prompt-eng-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50d13a939bff8534fbbcbd6ae07836fc1f121c90e239d09b6a76cd91e8e202c2 The package prompt-eng-server was found to contain malicious code. Source: google-open-source-security...

Malicious code in @huntersofbook/auth-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974ee7f388d04b8f3f79de89e780575aab1d7ed2ea4d7ea1a52420d81911f993 The package @huntersofbook/auth-vue was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191285 Malicious code in @pergel/module-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0481d4c0ca9178f58c5a7a14ae396a916f1ff2f36d5066f2565bf521d75cdb5 The package @pergel/module-box was found to contain malicious code. Source: google-open-source-security...

Malicious code in @afetcan/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0a79aa802450fc62bcdf8bdb70d6619752f6db790e68472e80016d5893111ba The package @afetcan/api was found to contain malicious code. Source: google-open-source-security...

Malicious code in @alexadark/amadeus-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77dd4490e1bb80e5b23c2e2181146133e356e9a42967ae02883630c49378fb26 The package @alexadark/amadeus-api was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191204 Malicious code in @clausehq/flows-step-sendgridemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e11e222c60736d3fbf0e7d232067bc608dbfdcb99484a13122cd9d2acd27f7 The package @clausehq/flows-step-sendgridemail was found to contain malicious code. Source: ghsa-malware...