MongoSQL Transition Readiness Tool fails to encode database metadata before embedding it into the generated HTML report. When a MongoDB user with write access inserts crafted metadata, subsequent users who open the report may execute that content in the browser. This classic HTML injection flaw can lead to the disclosure of report data or manipulation of the page’s appearance. The issue is classified as CWE‑79 and presents a moderate threat to confidentiality and integrity of the report consumption process.

The affected component is the MongoDB BI Connector Transition Readiness Report (MongoSQL Transition Readiness Tool). No specific product version numbers were provided in the advisory, so any deployment of this tool that has not applied the latest update is potentially vulnerable.

The CVSS score of 4.8 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a user with database write privileges to add malicious metadata, and the exploit is triggered when another user generates and opens the report. Because the flaw arises from insufficient HTML encoding, an attacker can execute arbitrary script code in the victim’s browser, possibly leaking session data or altering the report display.