CVE-2026-77184: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MongoDB BI Connector

In MongoDB Connector for BI version 2.1.0, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. This improper neutralization of special elements (CWE-89) enables a user with permission to modify the schema validator to inject additional SQL text into the generated SQL schema. If an operator or automated tool subsequently executes this generated SQL statement against a SQL server, the injected SQL commands execute with the privileges of that session, potentially leading to unauthorized actions.

An attacker with permission to modify a collection's schema validator can inject arbitrary SQL commands into the generated SQL schema output. If this output is executed by an operator or automated tool, the injected commands run with the privileges of that SQL session, which could lead to unauthorized data access or modification. The vulnerability requires user interaction and privileges to modify the schema validator, limiting the attack scope. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to modify collection schema validators to trusted users only. Avoid replaying generated SQL schema statements from untrusted sources without review.