CVE-2026-10042

Critical

Description

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.

SeverityCritical

CVSS9.8

Exploit probability—

ProductZyddnys Manga-image-translator

PublishedMay 29, 2026

First seenMay 29, 2026

Weakness typeCWE-502Deserialization of untrusted data

How to fix

Patches

github.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94d

Affected products

Product	Affected versions	Fixed in
zyddnys manga-image-translator	v ≤ d744148	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.