manga-image-translator Shared API Unsafe Deserialization RCE
Summary
| CVE | CVE-2026-26215 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-02-11 23:16:10 UTC |
| Updated | 2026-07-14 16:16:58 UTC |
| Description | manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.009230000 probability, percentile 0.562490000 (date 2026-07-14)
Problem Types: CWE-502 | CWE-502 CWE-502 Deserialization of Untrusted Data
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Zyddnys | Manga-image-translator | affected beta-0.3 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| chocapikk.com/posts/2026/manga-image-translator-pickle-rce | [email protected] | chocapikk.com | |
| github.com/zyddnys/manga-image-translator/blob/a537cb12b41daf2065795058c... | [email protected] | github.com | |
| github.com/zyddnys/manga-image-translator/issues/1116 | [email protected] | github.com | |
| github.com/zyddnys/manga-image-translator/blob/a537cb12b41daf2065795058c... | [email protected] | github.com | |
| github.com/zyddnys/manga-image-translator/issues/946 | [email protected] | github.com | |
| www.vulncheck.com/advisories/manga-image-translator-shared-api-unsafe-deseriali... | [email protected] | www.vulncheck.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Valentin Lobstein (Chocapikk) (en)
CNA: sud0why of Tencent YunDing Security Lab (en)
Additional Advisory Data
Workarounds
CNA: Set the MT_WEB_NONCE environment variable or pass --nonce=<secret> at startup.
There are currently no legacy QID mappings associated with this CVE.