# CVE-2026-76794: MongoDB MongoSQL Transition Readiness Tool XSS in HTML report generation

Source: https://junglewise.ai/threats/cve-2026-76794-mongodb-mongosql-transition-readiness-tool-xss-in-html-report  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76794 · Severity: medium · CVSS 4.6 · Published 2026-08-28

MongoDB's MongoSQL Transition Readiness Tool is a utility used to help organizations assess readiness for migrating from SQL systems to MongoDB's SQL interface. The tool generates HTML reports that can be shared among team members. A MongoDB user with write access can inject malicious script code into database metadata, which executes when another user opens the generated report, potentially exposing sensitive report contents or modifying how the report appears.

Technologies: [MongoDB Mongosql Transition Readiness Tool](https://junglewise.ai/threats/technologies/mongosql-transition-readiness-tool). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-76794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76794 being exploited in the wild.

**How severe is CVE-2026-76794?** Medium severity, with a CVSS score of 4.6, published 28 August 2026.

**Which products and versions are affected?** MongoDB Mongosql Transition Readiness Tool <UNKNOWN>.

**Is there a fix for CVE-2026-76794?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76794 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76794?** Check whether you run MongoDB Mongosql Transition Readiness Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a cross-site scripting (XSS) vulnerability in the MongoSQL Transition Readiness Tool's HTML report generation feature. The vulnerability occurs because the tool does not adequately HTML-encode database metadata before embedding it into generated HTML reports. An attacker with database write access can craft metadata containing JavaScript code; when a victim generates and opens the report in a web browser, the unencoded payload executes in the victim's context. This allows the attacker to exfiltrate report contents, manipulate the report display, or potentially perform other malicious actions. The attack requires both attacker write access to the database and victim interaction (opening the report).

## Affected products

- MongoDB MongoSQL Transition Readiness Tool <UNKNOWN>

## Timeline

- 2026-08-28: disclosed

## References

- [https://www.mongodb.com/docs/sql-interface/changelog/](https://www.mongodb.com/docs/sql-interface/changelog/)

## Related threats

- [MongoDB BI Connector Transition Readiness Tool cross-site scripting in HTML report generation](https://junglewise.ai/threats/cve-2026-76798-mongodb-bi-connector-transition-readiness-tool-cross-site)
- [MongoDB MongoSQL Transition Readiness Tool CSV formula injection](https://junglewise.ai/threats/cve-2026-76797-mongodb-mongosql-transition-readiness-tool-csv-formula-injection)