CVE-2026-76794

Awaiting Analysis Awaiting Analysis - Queue

MongoDB XSS in MongoSQL Transition Readiness Tool

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-76794

EUVD

EUVD-2026-67873

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

MongoSQL Transition Readiness Tool fails to properly encode database metadata before including it in HTML reports. This allows a MongoDB user with write access to inject malicious scripts into metadata, which executes when another user generates and opens the report. The issue exposes report contents or alters its display through cross-site scripting (XSS).

Impact Analysis

If you generate MongoSQL reports, an attacker with write access could steal sensitive data from your reports or manipulate their content. The injected scripts run in your browser context, potentially exposing credentials or other confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update MongoSQL Transition Readiness Tool to the latest version to ensure proper encoding of database metadata in generated HTML reports.

Hi! I’m here to help you understand CVE-2026-76794. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70