CVE-2026-76794: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MongoDB BI Connector Transition Readiness Report

This vulnerability (CVE-2026-76794) involves improper neutralization of input during web page generation (CWE-79) in the MongoDB BI Connector Transition Readiness Report. Specifically, the MongoSQL Transition Readiness Tool fails to sufficiently encode database metadata before embedding it into HTML output. An attacker with write privileges to the database can insert malicious metadata that triggers script execution in the context of another user who generates and opens the report. This could lead to unauthorized disclosure of report data or manipulation of the report's presentation. The vulnerability affects version 1.0.0 of the product. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

The vulnerability allows a user with write access to the MongoDB database to inject malicious metadata that executes script code in the browser of another user generating the Transition Readiness Report. This could result in exposure of sensitive report contents or alteration of the report's display. The CVSS 4.8 score reflects a medium severity impact with network attack vector, low complexity, and requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to trusted users only to reduce the risk of malicious metadata injection. Monitor vendor communications for updates on patches or official mitigations.