CVE-2026-26215
BaseFortify
Publication date: 2026-02-11
Last updated on: 2026-02-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zyddnys | manga-image-translator | to beta-0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in manga-image-translator version beta-0.3 and earlier when running in shared API mode. It involves unsafe deserialization where the FastAPI endpoints /simple_execute/{method} and /execute/{method} use pickle.loads() to deserialize request bodies without proper validation.
Although there is a nonce-based authorization check intended to restrict access, the nonce defaults to an empty string and the check is skipped. This allows remote attackers to send crafted pickle payloads that execute arbitrary code on the server without authentication.
How can this vulnerability impact me? :
This vulnerability can lead to unauthenticated remote code execution on the server running the vulnerable manga-image-translator application.
- Attackers can execute arbitrary code in the server context.
- This can result in full compromise of the server, including data theft, service disruption, or further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know