EUVD-2026-33328
GHSA-xx7c-f2fq-qmv3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.
AnalysisAI
{method_name} and /simple_execute/{method_name} endpoints, which call pickle.loads() on raw HTTP request bodies. The flaw scored CVSS 4.0 of 9.2 and has an upstream fix in commit d7441481, but no public exploit was identified at time of analysis; risk is amplified by the default Docker image running as root, leading to full container compromise.
Technical ContextAI
manga-image-translator is an open-source Python application (vendor zyddnys per the CPE cpe:2.3:a:zyddnys:manga-image-translator:*) that exposes a shared API server mode implemented in manga_translator/mode/share.py. The vulnerability is a textbook CWE-502 Deserialization of Untrusted Data: Python's pickle module executes arbitrary callables embedded in the byte stream during loads(), so any endpoint that pickle.loads() attacker-controlled bytes is effectively an RCE primitive. The PR diff confirms two unsafe call sites - one previously gated by a 'nonce is None' branch and another unconditional - both now routed through a restricted_loads() wrapper that constrains permitted classes.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the patch from commit d7441481a7ed3236b4e0456670a9962a8c82d94d (PR #1142) which replaces pickle.loads() with restricted_loads() at both call sites in manga_translator/mode/share.py, by pulling latest main or rebuilding the Docker image from a source tree containing that commit. Until the patch is deployed, disable the shared API server mode entirely if it is not required, or block network access to the /execute/{method_name} and /simple_execute/{method_name} endpoints with an upstream reverse proxy or firewall rule (trade-off: any client legitimately using the share API will break). Operators who must keep the service exposed should additionally stop running the container as root by adding a USER directive or docker run --user flag and dropping Linux capabilities, which reduces post-exploitation impact from full container takeover to a constrained process even if the deserialization is reached. See the vendor advisory at https://github.com/zyddnys/manga-image-translator/issues/1141 and the VulnCheck writeup at https://www.vulncheck.com/advisories/manga-image-translator-rce-via-unsafe-pickle-deserialization-in-share-model.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today