CVE-2026-10042 manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model
Remote attackers can execute arbitrary code by sending malicious pickle payloads to the share API endpoints, leading to full server compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10042?
CVE-2026-10042 is a critical unsafe deserialization vulnerability in zyddnys manga-image-translator, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.
Weakness: CWE-502
Which versions are affected by CVE-2026-10042?
How do I fix CVE-2026-10042?
No fix has been published for CVE-2026-10042 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-10042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10042 exists.
Sources
Also known as GHSA-xx7c-f2fq-qmv3.