Arelle versions earlier than 2.39.10 expose an unauthenticated remote code execution flaw within the /rest/configure REST endpoint. The endpoint accepts a plugins query parameter and forwards the value unchecked to the plugin manager, allowing attackers to specify a URL pointing to a malicious Python file. The Arelle web server then downloads and executes the supplied code using the privileges granted to the Arelle process. This flaw provides attackers with the ability to run arbitrary code with the same permissions as the server, potentially compromising confidentiality, integrity, or availability of the system.

The affected product is Arelle, all releases prior to 2.39.10. Users deploying Arelle before the 2.39.10 release are at risk if the /rest/configure endpoint is reachable over the network.

The vulnerability has a CVSS score of 9.2, indicating a high‑severity risk. EPSS data is not available, but the absence of a KEV listing does not reduce the danger; attackers can exploit the exposed endpoint remotely without any need for authentication or privilege escalation steps. The likely attack vector is a web‑based request to the vulnerable endpoint from an external attacker, which then triggers the download and execution of attacker‑controlled code within the Arelle process.