---
id: CVE-2026-76797
title: >-
  The MongoSQL Transition Readiness Tool writes database and collection names
  into its generated CSV reports without neutralizing leading characters that
  spreadsheet applications treat as formulas
summary: >-
  The MongoSQL Transition Readiness Tool writes database and collection names
  into its generated CSV reports without neutralizing leading characters that
  spreadsheet applications treat as formulas. A user with write privileges on
  the clust…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-1236
vendor: mongodb
product: mongosql_transition_readiness_tool
affected:
  - mongosql_transition_readiness_tool < 1.1.3
patched:
  - mongosql_transition_readiness_tool 1.1.3
published: '2026-08-28'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T14:37:45.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76797'
references:
  - url: 'https://www.mongodb.com/docs/sql-interface/changelog/'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00252
epssPercentile: 0.17
ingestedAt: '2026-09-17T15:20:38.957Z'
---

## Overview

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.

## Affected

- `mongosql_transition_readiness_tool < 1.1.3`

## Remediation

Upgrade past the affected range:

- `mongosql_transition_readiness_tool 1.1.3`