CVE-2026-42796

CVE-2026-42796 is an unauthenticated remote code execution vulnerability affecting Arelle versions prior to 2.39.10. The issue resides in the /rest/configure REST endpoint, which accepts a plugins query parameter and passes it directly to the plugin manager without any authentication or authorization checks. By supplying a URL pointing to a malicious Python file via this parameter, an attacker can cause the Arelle webserver to download and execute the attacker-controlled code within the Arelle process, running with its existing privileges. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-306 (Missing Authentication for Critical Function).

Any unauthenticated remote attacker with network access to the Arelle webserver can exploit this vulnerability by crafting an HTTP request to the /rest/configure endpoint with a malicious plugins parameter. Successful exploitation leads to arbitrary code execution on the server, potentially allowing full compromise of the Arelle process, including high confidentiality, integrity, and availability impacts as reflected in the CVSS vector.

Mitigation is available through upgrading to Arelle version 2.39.10 or later, as detailed in the project's release notes. The fixing pull request (#2320) on the Arelle GitHub repository addresses the lack of authentication by implementing proper checks in the plugin manager. Additional details on the vulnerability and exploitation are provided in the Vulncheck advisory.