{"affected":[{"defaultStatus":"unknown","product":"manga-image-translator","source":"CNA: VulnCheck","vendor":"zyddnys","versions":[{"lessThanOrEqual":"d744148","status":"affected","version":"0","versionType":"git"}]}],"cveId":"CVE-2026-10042","cwes":["CWE-502"],"description":"manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.","epss":{"date":"2026-11-08","percentile":0.50103,"score":0.00622},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/zyddnys/manga-image-translator/issues/1141"}],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.2,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794146436059,"publishedAt":1780064961547,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/zyddnys/manga-image-translator/issues/1141"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/zyddnys/manga-image-translator/pull/1142"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94d"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/manga-image-translator-rce-via-unsafe-pickle-deserialization-in-share-model"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/zyddnys/manga-image-translator/issues/1141"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zyddnys/manga-image-translator/pull/1142"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zyddnys/manga-image-translator/commit/d7441481a7ed3236b4e0456670a9962a8c82d94d"}],"revision":"358f2da4a50b1e9851c62f73ba8712b189e82529fd1637e34a710a8e9d18a3ef","sources":[{"modifiedAt":1794146436059,"name":"CNA: VulnCheck","retrievedAt":1794146995060,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10042"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150620057,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10042"}],"ssvc":{"assessedAt":1780067013548,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model","updatedAt":1794150620057}