CVE-2026-42796

CVE-2026-42796 affects Arelle prior to 2.39.10. An unauthenticated remote code execution exists in the /rest/configure REST endpoint, where the plugins parameter is forwarded to the plugin manager without auth. An attacker can supply a URL to a malicious Python file via plugins, causing the Arell...