CVE-2026-10042 Overview
CVE-2026-10042 is a remote code execution vulnerability in manga-image-translator, an open-source tool for translating text in manga images. The flaw resides in the shared API server mode implemented in the share.py module. The /execute/{method_name} and /simple_execute/{method_name} endpoints pass attacker-controlled HTTP request bodies directly to pickle.loads(). Unauthenticated remote attackers can submit crafted pickle payloads to achieve arbitrary code execution in the server process. The issue is classified under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Remote, unauthenticated attackers can execute arbitrary code on the server. In the default Docker deployment, the process runs as root, leading to full container compromise.
Affected Products
- manga-image-translator shared API server mode (share.py)
- Default Docker deployments exposing the share endpoints
- Versions prior to commit d7441481a7ed3236b4e0456670a9962a8c82d94d
Discovery Timeline
- 2026-05-29 - CVE-2026-10042 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-10042
Vulnerability Analysis
The vulnerability stems from unsafe use of Python's pickle module on data sourced from HTTP request bodies. The shared API server defines two route handlers, /execute/{method_name} and /simple_execute/{method_name}, in share.py. Both handlers read the raw HTTP body and pass it to pickle.loads() without validation, authentication, or type restriction. Python's pickle module is documented as unsafe for untrusted input because deserialization can trigger arbitrary callables via the __reduce__ protocol.
An attacker only needs network reachability to the exposed endpoint. Sending a serialized object whose __reduce__ method returns a tuple of os.system (or any callable) and arguments causes immediate execution during deserialization. No authentication is required and no exploit chain is needed beyond a single HTTP POST.
Root Cause
The root cause is direct invocation of pickle.loads() on attacker-controlled bytes. The share endpoints were designed to accept Python objects as method arguments but did not adopt a safe serialization format such as JSON or MessagePack. There is no signature verification, allowlist of classes, or sandbox around the deserialization call.
Attack Vector
Exploitation requires sending an HTTP POST request to either /execute/{method_name} or /simple_execute/{method_name} with a malicious pickle byte stream as the body. The crafted object's reducer executes shell commands, spawns reverse shells, or writes files when deserialized. Because the default Docker image runs the service as root, code execution yields full container privileges and access to mounted volumes, secrets, and the container network. See the VulnCheck RCE Advisory and GitHub Issue #1141 for technical analysis.
Detection Methods for CVE-2026-10042
Indicators of Compromise
- HTTP POST requests to /execute/ or /simple_execute/ paths containing binary (non-JSON) request bodies.
- Request bodies beginning with the pickle protocol magic bytes \\x80\\x04 or \\x80\\x05.
- Unexpected child processes spawned by the manga-image-translator Python interpreter, such as sh, bash, curl, or wget.
- Outbound network connections from the container to unfamiliar hosts following requests to the share endpoints.
Detection Strategies
- Inspect web server and reverse-proxy logs for requests to the vulnerable endpoints originating from untrusted networks.
- Apply WAF or IDS signatures that flag pickle magic bytes (\\x80\\x04, \\x80\\x05) in HTTP request bodies.
- Monitor container runtime telemetry for the manga-image-translator process invoking shell interpreters or network utilities.
Monitoring Recommendations
- Forward container stdout, stderr, and audit logs to a centralized log pipeline and alert on new process trees under the Python service.
- Baseline egress traffic from translator containers and alert on connections outside the expected model and API destinations.
- Track filesystem writes inside the container, particularly to /tmp, /root, and any mounted volumes.
How to Mitigate CVE-2026-10042
Immediate Actions Required
- Update manga-image-translator to a build that includes commit d7441481a7ed3236b4e0456670a9962a8c82d94d or later.
- Disable shared API server mode if it is not required for your deployment.
- Restrict network access to the share endpoints using firewall rules, reverse-proxy ACLs, or private network segmentation.
- Stop running the Docker container as root and rebuild with a non-privileged user.
Patch Information
The maintainers addressed the issue in GitHub Pull Request #1142, merged as commit d7441481a7ed3236b4e0456670a9962a8c82d94d. The fix removes unsafe pickle.loads() usage on untrusted request bodies in share.py. Operators should pull the latest container image or update the source tree and redeploy.
Workarounds
- Place the service behind an authenticated reverse proxy that blocks /execute/ and /simple_execute/ paths from untrusted clients.
- Run the container with a read-only root filesystem and a non-root user to limit post-exploitation impact.
- Apply egress network policies that prevent the container from initiating arbitrary outbound connections.
- Add a WAF rule rejecting requests to the share endpoints whose bodies are not valid JSON.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
