CVE-2026-26215
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability in manga-image-translator version beta-0.3 and prior, running in shared API mode, allows unauthenticated remote code execution through unsafe deserialization. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled data using pickle.loads() without validation, and the nonce-based authorization check is bypassed because the nonce defaults to an empty string.
Risk Assessment
An attacker can remotely execute arbitrary code on the server without authentication, leading to full system compromise, data theft, or service disruption.
Recommendation
Immediately update manga-image-translator to the latest version that fixes this vulnerability. If an update is not possible, disable shared API mode or apply additional network security measures such as firewalls and endpoint access restrictions.
Original NVD description (English source)
manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload.