EUVD-2026-67873
GHSA-xpfg-hqpq-mf5g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires authenticated write access (PR:L) and victim report-viewing (UI:R); scope changes as payload executes cross-user in browser.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.
AnalysisAI
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a MongoDB account with write access to at least one database or collection whose metadata is ingested by the report tool - this is the primary limiting condition established by the PR:L CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 4.8 (Medium) reflects the realistic constraint profile: PR:L confirms that write-level MongoDB access is a prerequisite, and UI:A confirms the victim must actively open the generated report - two meaningful barriers that reduce automated exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the MongoDB SQL interface changelog at https://www.mongodb.com/docs/sql-interface/changelog/ for any released patch or updated version of the BI Connector Transition Readiness Report tool; no exact fix version was independently confirmed from the available input data, so the patch status should be verified directly with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadshee
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today