CVE-2026-10042CWE-502

manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model

Critical · published May 29, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00622 · 49.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-05-29T14:29Z
EPSS history
Timeline
  • 29 MAY 14:29Z
    manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model
    cvelistv5