CVE-2026-10042
manga-image-translator has a critical remote code execution vulnerability. Attackers can send a crafted pickle payload to specific API endpoints, causing arbitrary code execution on the server. This can lead to full compromise of the container, especially when running as root.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
manga-image-translator, any version that runs the shared API server mode, typically used in Docker deployments.
Real-world impact
An attacker could run arbitrary code on the server, taking control of the container and potentially accessing or modifying data, or using the host system.
Why this severity
The CVSS score of 9.2 reflects the high impact of remote code execution with no authentication or user interaction required, and the ability to compromise the entire container.
What to do about it
- ›Disable the shared API server mode or remove the /execute and /simple_execute endpoints.
- ›Restrict network access to the API endpoints so only trusted hosts can reach them.
- ›Run the container as a non‑root user instead of the default root account.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.