CVE-2026-77184: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MongoDB BI Connector

In MongoDB Connector for BI version 2.1.0, the JSON schema validator's description text is incorporated into the comment section of DDL statements returned by SHOW CREATE commands without complete escaping of backslash characters. This improper neutralization allows a user with permission to modify a collection's schema validator to inject additional SQL commands into the generated SQL output. If an operator or automated process subsequently executes this generated SQL statement on a SQL server, the injected SQL code executes with the privileges of that session, leading to potential unauthorized actions.

The vulnerability allows a user with permission to modify a collection's JSON schema validator to inject arbitrary SQL commands into the generated SQL schema output. If this output is executed on a SQL server, the injected commands run with the privileges of that session, potentially leading to unauthorized data manipulation or other SQL-level impacts. The CVSS 4.0 base score is 5.6 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, and high impact on confidentiality and integrity.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict permissions to modify collection schema validators to trusted users only and avoid replaying generated SQL statements from SHOW CREATE outputs without thorough review or sanitization.