The vulnerability lies in the MongoDB Connector for BI, where a collection’s JSON schema validator description is inserted into the COMMENT portion of the DDL produced by SHOW CREATE commands without fully escaping backslashes. An authorized user who can modify a schema validator can inject additional SQL code into this comment. When the generated DDL is later executed against a SQL server—either by an operator or an automated tool—the injected text runs with the current session’s privileges, offering an avenue for arbitrary SQL execution. This flaw is an instance of improper escaping (CWE‑89) and can be leveraged to bypass normal authorization controls and run malicious SQL statements.

MongoDB BI Connector (MongoDB:BI Connector). No specific version range is listed in the advisory, so any deployments running the affected product before the referenced release notes update are potentially affected. Operators should verify the Connector version against the official MongoDB release notes to determine exposure.

The CVSS score of 5.6 indicates moderate severity; the EPSS score is not available, so exploitation probability cannot be quantified from this data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user who has permission to alter a collection’s schema validator, a privilege typically restricted to administrators or privileged staff. After insertion, the attacker must trigger re‑execution of the generated DDL against a SQL server. While the attack path is somewhat constrained to internal users with specific rights, the impact—unrestricted SQL code execution—makes it a significant risk if those privileges are misused.