{"id":"CVE-2026-76797","title":"The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas","summary":"The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the clust…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-1236"],"vendor":"mongodb","product":"mongosql_transition_readiness_tool","affected":["mongosql_transition_readiness_tool < 1.1.3"],"patched":["mongosql_transition_readiness_tool 1.1.3"],"published":"2026-08-28","updated":"2026-09-17","sourceUpdated":"2026-09-17T14:37:45.523","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76797","references":[{"url":"https://www.mongodb.com/docs/sql-interface/changelog/","label":"cna@mongodb.com"}],"tags":["nvd"],"epss":0.00252,"epssPercentile":0.16992,"ingestedAt":"2026-09-17T15:20:38.957Z","slug":"CVE-2026-76797","body":"## Overview\n\nThe MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.\n\n## Affected\n\n- `mongosql_transition_readiness_tool < 1.1.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mongosql_transition_readiness_tool 1.1.3`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}