Junglewise Threat Intelligence

CVE-2026-10042: zyddnys manga-image-translator RCE via unsafe pickle deserialization

CVE-2026-10042 · Severity: critical · CVSS 9.8 · Published 2026-05-29

Executive brief

manga-image-translator is a tool used to translate text within manga and other images. A security flaw in its shared API server mode allows an attacker to take complete control of the server by sending a specially crafted request. This could lead to the theft of data, unauthorized access to the hosting environment, or a total service outage, especially since the application often runs with high privileges in Docker environments.

Technical details

A remote code execution (RCE) vulnerability exists in manga-image-translator's shared API server mode due to the use of the unsafe 'pickle.loads()' function on untrusted input. The vulnerability is located in the 'share.py' module, specifically affecting the '/execute/{method_name}' and '/simple_execute/{method_name}' endpoints. An unauthenticated attacker can send a crafted Python pickle payload in the HTTP request body to trigger arbitrary code execution. In default Docker deployments, the process runs as root, leading to full container compromise. The issue was addressed by replacing 'pickle.loads()' with a 'restricted_loads()' function that implements a module allowlist.

Affected products

  • zyddnys manga-image-translator versions prior to commit d744148

Timeline

  • 2026-05-09: disclosed: Issue reported on GitHub
  • 2026-05-19: patched: Fix merged via commit d744148
  • 2026-05-29: advisory: NVD advisory published

References

Related threats