VulnSocial

CVE-2026-26215Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 2 mentions (2026-02-11); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-02-11: 2Mentions · 2026-02-12: 2Patch / Workaround · 2026-02-12: 1Technical Details · 2026-02-11: 2Technical Details · 2026-02-12: 202-1102-12
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • Chocapikk 🤘🏻@Chocapikk_
    Disclosure

    CVE-2026-26215 - Unauthenticated RCE in manga-image-translator (9.3k stars) Two FastAPI endpoints call pickle.loads() on raw HTTP bodies. Auth exists but defaults to an empty string, which is falsy in Python, so the check never runs. First reported by sud0why in May 2025, auto-closed by a stale bot. Still unpatched. https://chocapikk.com/posts/2026/manga-image-translator-pickle-rce/

    Post summary

    The post discloses an unauthenticated RCE in manga-image-translator caused by insecure pickle.loads() usage; no patch or PoC is provided, and no active exploitation is reported.

    16051254.0K
    3.9K followersView on X
  • OffSeq | Adversary Tactics for Cyber Resilience@offseq
    Disclosure

    🚨 CRITICAL RCE alert! CVE-2026-26215 affects zyddnys manga-image-translator (beta-0.3 & prior) — unauthenticated attackers can execute code via unsafe pickle deserialization. Restrict API access NOW! https://radar.offseq.com/threat/cve-2026-26215-cwe-502-deserialization-of-unt... https://t.co/91aMCURyZT

    Post summary

    The tweet reports a critical RCE vulnerability (CVE-2026-26215) in zyddnys manga-image-translator caused by unsafe pickle deserialization, warning of unauthenticated code execution and recommending API restriction.

    0000052
    268 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-26215 Unauthenticated Remote Code Execution in Manga Image Translator API via Unsafe Deserialization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26215

    Post summary

    The text announces CVE‑2026‑26215, describing an unauthenticated remote code execution vulnerability in the Manga Image Translator API caused by unsafe deserialization.

    0000058
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-26215 manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code exe… https://www.cve.org/CVERecord?id=CVE-2026-26215

    Post summary

    The post discloses that manga‑image‑translator (beta‑0.3 and earlier) has an unsafe deserialization flaw enabling unauthenticated remote code execution, without mentioning a PoC, exploit, patch, or active exploitation.

    00000158
    56.5K followersView on X

Explore more

Back to dashboard