CVE-2026-76797: CWE-1236: Improper Neutralization of Formula Elements in a CSV File in MongoDB BI Connector Transition Readiness Report

The MongoSQL Transition Readiness Tool generates CSV reports containing database and collection names. These names are written without neutralizing leading characters that spreadsheet software treats as formulas. This improper neutralization (CWE-1236) allows a user with write privileges to craft namespace names that, when included in the report and opened in a spreadsheet application, are evaluated as formulas. This can result in unintended disclosure of report contents or execution of external content on the operator's workstation. The vulnerability affects version 1.0.0 of the BI Connector Transition Readiness Report. Exploitation requires generating and opening the report in a spreadsheet application.

An attacker with write privileges on the MongoDB cluster can create namespace names that cause spreadsheet applications to evaluate formulas when the CSV report is opened. This may lead to unintended disclosure of report data or execution of external content on the operator's machine. The impact is limited by the need for write privileges and user interaction to open the report in a spreadsheet application.

No official patch or remediation level is currently provided for this vulnerability. Users should exercise caution when opening CSV reports generated by the MongoDB BI Connector Transition Readiness Tool, especially if the report contains untrusted namespace names. Consider sanitizing or neutralizing leading characters in CSV fields before opening in spreadsheet applications. Monitor the vendor advisory for updates on official fixes or mitigations.