CVE-2026-26215

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload.

• CWE-502

• https://chocapikk.com/posts/2026/manga-image-translator-pickle-rce/
• https://github.com/zyddnys/manga-image-translator/blob/a537cb12b41daf2065795058c2753d87e73fa0fe/manga_translator/mode/share.py#L112
• https://github.com/zyddnys/manga-image-translator/blob/a537cb12b41daf2065795058c2753d87e73fa0fe/manga_translator/mode/share.py#L130
• https://github.com/zyddnys/manga-image-translator/issues/1116
• https://github.com/zyddnys/manga-image-translator/issues/946
• https://www.vulncheck.com/advisories/manga-image-translator-shared-api-unsafe-deserialization-rce

Published

Feb 11, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2621A security vulnerability has been detected in Sciyon Koyuan …7.3
• CVE-2026-26210KTransformers through 0.5.3 contains an unsafe deserializati…9.8
• CVE-2026-26211Ekushey Project Manager CRM stores the administrator-configu…4.8
• CVE-2026-26212Rara One Click Demo Import plugin for WordPress before 1.3.5…7.2
• CVE-2026-26213thingino-firmware versions up to the firmware-2026-03-16 rel…9.8
• CVE-2026-26214Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versi…9.1
• CVE-2026-26216Crawl4AI versions prior to 0.8.0 contain a remote code execu…10
• CVE-2026-26217Crawl4AI versions prior to 0.8.0 contain a local file inclus…7.5
• CVE-2026-26218newbee-mall includes pre-seeded administrator accounts in it…9.8
• CVE-2026-26219newbee-mall stores and verifies user passwords using an unsa…9.3
• CVE-2026-2622A vulnerability was detected in Blossom up to 1.17.1. This v…5.4
• CVE-2026-26220LightLLM version 1.1.0 and prior contain an unauthenticated …9.3