/Vulnerability Library

Arelle < 2.39.10 - Remote Code Execution

CVE-2026-42796
Verified

Description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Affected Product

arelle

Published Date

July 16, 2026

Template Author

aryu-ru

CVE-2026-42796.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-42796
CWE ID:
cwe-306

References

https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configurehttps://github.com/Arelle/Arelle/pull/2320https://github.com/Arelle/Arelle/releases/tag/2.39.10https://nvd.nist.gov/vuln/detail/CVE-2026-42796

Remediation Steps

Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.