Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses

Filter by:

With package: python312Packages.arelle-headless

Found 1 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-42796

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

References

https://github.com/Arelle/Arelle/releases/tag/2.39.10 release-notespatch
https://github.com/Arelle/Arelle/pull/2320 issue-tracking
https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-config… third-party-advisory

Affected products

Arelle

<2.39.10

Matching in nixpkgs

pkgs.arelle

Open source XBRL platform

nixos-unstable 2.38.7
- nixpkgs-unstable 2.38.7
- nixos-unstable-small 2.38.7
nixos-25.11 2.37.72
- nixos-25.11-small 2.37.72
- nixpkgs-25.11-darwin 2.37.72

pkgs.python312Packages.arelle

Open source XBRL platform

nixos-25.11 2.37.72
- nixos-25.11-small 2.37.72
- nixpkgs-25.11-darwin 2.37.72

pkgs.python313Packages.arelle

Open source XBRL platform

nixos-unstable 2.38.7
- nixpkgs-unstable 2.38.7
- nixos-unstable-small 2.38.7
nixos-25.11 2.37.72
- nixos-25.11-small 2.37.72
- nixpkgs-25.11-darwin 2.37.72

pkgs.python314Packages.arelle

Open source XBRL platform

nixos-unstable 2.38.7
- nixpkgs-unstable 2.38.7
- nixos-unstable-small 2.38.7

pkgs.python312Packages.arelle-headless

Open source XBRL platform

nixos-25.11 2.37.72
- nixos-25.11-small 2.37.72
- nixpkgs-25.11-darwin 2.37.72

pkgs.python313Packages.arelle-headless

Open source XBRL platform

nixos-unstable 2.38.7
- nixpkgs-unstable 2.38.7
- nixos-unstable-small 2.38.7
nixos-25.11 2.37.72
- nixos-25.11-small 2.37.72
- nixpkgs-25.11-darwin 2.37.72

pkgs.python314Packages.arelle-headless

Open source XBRL platform

nixos-unstable 2.38.7
- nixpkgs-unstable 2.38.7
- nixos-unstable-small 2.38.7

Package maintainers

@roberth Robert Hensing <nixpkgs@roberthensing.nl>
@TomaSajt TomaSajt

1