CVE-2026-76798: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MongoDB BI Connector Transition Readiness Report

The MongoSQL Transition Readiness Tool generates an HTML report from BI Connector log files, including query text and user names. These inputs are not properly encoded for HTML output, leading to improper neutralization of input during web page generation (CWE-79). A user able to submit queries via the BI Connector can inject HTML or script code into the logs. When an operator generates and opens the report, the injected markup is executed by the browser, potentially disclosing logged query text and user names to external parties or presenting misleading content to the operator. This vulnerability affects version 1.0.0 of the BI Connector Transition Readiness Report.

Successful exploitation can lead to disclosure of sensitive logged query text and user names to unauthorized external parties or cause misleading content to be displayed to the operator viewing the report. The vulnerability requires that an attacker can submit queries through the BI Connector and that the operator generates and opens the affected report. There is no indication of privilege escalation or direct system compromise from the provided data.

No official fix or patch is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid generating and opening reports containing untrusted or suspicious BI Connector log entries. Applying input encoding or sanitization before report generation is recommended once a patch or update is released.