The MongoSQL Transition Readiness Tool outputs query strings and usernames extracted from BI Connector logs into an HTML report without escaping them. A user who can submit queries through the BI Connector can embed HTML or JavaScript markup into a query. When the report is later generated and viewed in a browser, the injected markup is interpreted, which may leak other users’ query text and usernames to an external party or display misleading content. This constitutes a stored XSS vulnerability that can compromise confidentiality of query data and the perceived integrity of the report.

The vulnerability affects the MongoDB BI Connector Transition Readiness Report feature, also referred to as the MongoSQL Transition Readiness Tool. All deployments that use this tool to generate HTML reports from BI Connector logs are potentially impacted. No specific affected versions are listed, so any version that includes the report generation logic is considered vulnerable until an official fix is released.

The CVSS score of 6.9 indicates a moderate severity. There is no EPSS data available and the issue is not listed in CISA KEV. Exploitation requires a user with permission to submit queries via the BI Connector to inject malicious markup into log entries, and an operator later to generate and open the report in a web browser. Because the attack path requires both a privileged query author and a report viewer, the likelihood is lower than a purely remote XSS, but the impact on data confidentiality and potential to mislead operators is significant.