CVE-2026-42796

Critical

Description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

SeverityCritical

CVSS9.8

Exploit probability—

ProductWorkiva Arelle

PublishedMay 4, 2026

First seenMay 4, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

workiva arelle2.39.10 or later

Patches

github.com/Arelle/Arelle/releases/tag/2.39.10

Affected products

Product	Affected versions	Fixed in
workiva arelle	v < 2.39.10	2.39.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.