The vulnerability occurs when object names in MongoDB collections are inserted into quoted identifiers in DDL text returned by SHOW CREATE statements without escaping the delimiter. If a user with permission to write to a sampled collection creates a name that terminates the quoted identifier, the subsequent SQL text becomes part of the generated output. When an operator or automated tool later replays that statement against a SQL server, the additional text is executed with the session privileges, leading to arbitrary SQL execution. This flaw is a classic SQL injection that can compromise database integrity and confidentiality.

MongoDB Connector for BI is affected for all releases that have not applied the vendor fix. No specific version range was disclosed, so any installed Connector should be considered vulnerable until the official patch is applied. The attack requires write access to a sampled collection, but the vulnerability is exploitable through the standard SHOW CREATE output used by BI tools.

The CVSS score of 8.5 indicates high severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to inject malicious object names and later trigger the replay of DDL statements, which can be performed by an insider or compromised user with write permissions. If the SQL server runs with elevated privileges, the impact could lead to full data compromise or denial of service.