CVE-2026-76794CWE-79cross-site-scripting

CVE-2026-76794

Medium · published August 29, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-29T00:19Z
Affected products (1)
ProductVersionsFixed in
mongodb/mongosql_transition_readiness_tool< 1.1.31.1.3
References (1)
https://www.mongodb.com/docs/sql-interface/changelog/ · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 19:23Z
    MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
    cvelistv5