by Kastro
Paper/Archive/CVE-2026-10042

CVE-2026-10042

zyddnys manga-image-translator — manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.

Affected

ProductAffectedFixed inSource
manga-image-translator≤ d744148–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/zyddnys/manga-image-translator/issues/1141refgithub.com/zyddnys/manga-image-translator/pull/1142patchgithub.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94dwriteupvulncheck.com/advisories/manga-image-translator-rce-via-unsafe-pickle-deserialization-in-share-model