{
  "cve_id": "CVE-2026-42796",
  "verdict": "confirmed",
  "vulnerable_version": "2.39.9",
  "fixed_version": "2.39.10",
  "reproduced": true,
  "description": "Arelle unauthenticated RCE via plugin URL parameter was successfully reproduced on version 2.39.9 and verified as fixed in version 2.39.10.",
  "evidence": {
    "vulnerable": {
      "http_code": 200,
      "sentinel_created": true,
      "response_summary": "Activation of plug-in evil_plugin successful, version 1.0."
    },
    "fixed": {
      "http_code": 400,
      "sentinel_created": false,
      "response_summary": "Remote URL plug-in references are not permitted via the webserver."
    }
  },
  "validation_notes": "The vulnerable version downloaded and executed the attacker-supplied Python plugin via the /rest/configure endpoint, creating a sentinel file (/tmp/arelle_pwned). The fixed version rejects remote plugin URLs with HTTP 400 before any code execution occurs.",
  "timestamp": "2026-05-23T06:28:38Z"
}