CVSS 4.0
9.2 criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-10042
Critical (9.2). EPSS 0.6% chance of exploitation in the next 30 days.
manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
References
- https://github.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94d
- https://github.com/zyddnys/manga-image-translator/issues/1141
- https://github.com/zyddnys/manga-image-translator/pull/1142
- https://www.vulncheck.com/advisories/manga-image-translator-rce-via-unsafe-pickle-deserialization-in-share-model
- https://github.com/zyddnys/manga-image-translator/issues/1141