Vulnerability · Published May 29, 2026 · Assigned by VulnCheck

CVE-2026-10042manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model

Critical 9.8

In plain English

A critical-severity unsafe deserialization in manga-image-translator from zyddnys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 50.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.

Affected products (as reported)

Vendor	Product	Versions
zyddnys	manga-image-translator	0 – through d744148

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/zyddnys/manga-image-translator/issues/1141 issue-tracking
https://github.com/zyddnys/manga-image-translator/pull/1142 issue-tracking
https://github.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94d patch
https://www.vulncheck.com/advisories/manga-image-translator-rce-via-unsafe-pickle-deserialization-in-share-model third-party-advisory