Junglewise Threat Intelligence

CVE-2026-26215: zyddnys manga-image-translator unsafe deserialization in shared API

CVE-2026-26215 · Severity: info · CVSS 9.3 · Published 2026-02-11

Executive brief

manga-image-translator is an open-source tool used to translate text within images, often deployed as a web service. A critical security flaw in its "shared API mode" allows an unauthenticated attacker to take complete control of the server. By sending a specially crafted request, an attacker can execute arbitrary commands, potentially leading to data theft, service disruption, or further network intrusion.

Technical details

The vulnerability is a class of unsafe deserialization (CWE-502) located in the 'shared API mode' of manga-image-translator. The FastAPI endpoints '/simple_execute/{method}' and '/execute/{method}' in 'manga_translator/mode/share.py' pass the raw HTTP request body directly to 'pickle.loads()' without validation. While a 'check_nonce()' function exists to protect these endpoints, it defaults to an empty string which evaluates as falsy in Python, causing the authentication check to be skipped entirely in standard deployments. An unauthenticated remote attacker can exploit this by sending a POST request containing a malicious Python pickle payload to achieve arbitrary code execution in the context of the server process. As of the advisory date, the vulnerability remains unpatched in version beta-0.3.

Affected products

  • zyddnys manga-image-translator beta-0.3 and prior

Timeline

  • 2025-05: disclosed: Initial report by Tencent YunDing Security Lab (Issue #946)
  • 2026-02-11: advisory: Independent discovery and public disclosure by Chocapikk
  • 2026-02-11: other: CVE-2026-26215 assigned by VulnCheck

References

Related threats