Security readout for executives and security teams
Plain-English summary
CVE-2026-26215 is a critical unauthenticated remote code execution risk in manga-image-translator shared API mode. A remote attacker may make the server deserialize untrusted data, which can run code in the server context. Public sources do not show KEV listing or confirmed active exploitation.
Executive priority
Prioritize immediate containment for any reachable shared API deployment. This is a critical server-takeover class issue with no user interaction or credentials required in the described vulnerable configuration.
Technical view
In beta-0.3 and prior, shared API FastAPI endpoints /simple_execute/{method} and /execute/{method} call pickle.loads() on attacker-controlled request bodies. The intended nonce authorization can default to an empty value and be skipped, making the vulnerable deserialization reachable without authentication.
Likely exposure
Exposure is likely limited to organizations running manga-image-translator beta-0.3 or earlier with shared API mode reachable over a network. Internet-facing or broadly internal deployments are highest risk.
Exploitation context
The advisory and technical write-up describe remote code execution and include exploit-oriented details. The provided bundle marks KEV as false, and no cited source confirms active exploitation in the wild.
Researcher notes
Evidence is strong for the vulnerable code path and authentication weakness from the CVE description, GitHub code references, and third-party advisory. Patch status is not established in the provided sources, so avoid claiming a fixed version without vendor confirmation.
Mitigation direction
- Disable shared API mode if it is not required.
- Block public access to shared API endpoints at the network edge.
- Require external authentication or trusted reverse proxy controls for any exposed service.
- Monitor the upstream project and advisories for a vendor-confirmed fixed release.
- Treat exposed hosts as potentially compromised and review for post-exploitation indicators.
Validation and detection
- Inventory manga-image-translator deployments and confirm version beta-0.3 or prior.
- Check whether shared API mode is enabled on any deployment.
- Identify reachability of /simple_execute/{method} and /execute/{method} from untrusted networks.
- Review configuration for default or empty nonce behavior.
- Check application and host logs for unexpected requests to shared API endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-26215 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://chocapikk.com/posts/2026/manga-image-translator-pickle-rce/CVE reference, VulnCheck · technical-description, exploit
- https://github.com/zyddnys/manga-image-translator/issues/1116CVE reference, VulnCheck · issue-tracking
- https://github.com/zyddnys/manga-image-translator/issues/946CVE reference, VulnCheck · issue-tracking
- https://github.com/zyddnys/manga-image-translator/blob/a537cb12b41daf2065795058c2753d87e73fa0fe/manga_translator/mode/share.py#L112CVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/manga-image-translator-shared-api-unsafe-deserialization-rceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.