Unsafe Deserialization Vulnerability in Manga Image Translator by Zyddnys
CVE-2026-26215

9.3CRITICAL

Key Information:

Vendor: Zyddnys
Status: Manga-image-translator
Vendor: CVE Published:; 11 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-26215?

The Manga Image Translator, particularly versions beta-0.3 and earlier, is vulnerable due to the unsafe deserialization of attacker-controlled inputs in shared API mode. Specifically, the FastAPI endpoints /simple_execute/{method} and /execute/{method} utilize pickle.loads() for deserialization without adequately validating the request bodies. Although designed to implement a nonce-based authorization check, this mechanism is bypassed as the nonce defaults to an empty string, thus allowing unauthorized access. This oversight permits remote attackers to send specially crafted pickle payloads, potentially executing arbitrary code within the server's context.

Affected Version(s)

manga-image-translator 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-26215 - Proof of Concept