CVE-2026-42796: critical vulnerability in Arelle
Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
65Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.2epss 2.7%
from disclosure to weapon4 days
Published on NVDMay 4
1st PoC+4d
VulnCheck+137d
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Arelle · Arellepublic PoCs found — 1
githubgithub.com/ameerhamza-malik/CVE-2026-42796★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.