External risk intelligence

Manga Image Translator Shared API Unsafe Deserialization Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-26215

The vulnerability resides in FastAPI endpoints exposed in a shared API mode. Services designed to function as APIs or shared image processing endpoints are commonly deployed as network-accessible services, making these endpoints potentially reachable from the network in many standard deployment configurations.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the manga-image-translator software that could allow unauthenticated remote code execution. This flaw exists in the shared API mode where certain endpoints deserialize untrusted data without proper validation, potentially enabling attackers to run arbitrary code on the server. While a security check is in place, it can be bypassed under default configurations, increasing the risk.

Unsafe data handling allows remote code execution.
Critical issue for networked shared API services.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the application's API endpoints over the network. These endpoints, when running in shared API mode, are designed to deserialize data without proper validation. This allows an unauthenticated attacker to send a malicious payload that executes arbitrary code on the server, potentially leading to a complete compromise of the system.

No authentication or privileges required.
Deserializing untrusted data via API endpoints.
Unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When the manga-image-translator application is running in shared API mode, an unauthenticated attacker could potentially execute arbitrary code on the server. This could occur if the application's API endpoints, which process user-supplied data through an unsafe deserialization mechanism, are accessible over the network. The default authorization checks are bypassed, allowing crafted requests to compromise the server's execution context.

Server-side code execution.
Via crafted network requests.
Full server compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The manga-image-translator's shared API mode, with its unprotected FastAPI endpoints, presents a critical remote code execution risk. Ownership likely falls to the team managing the API service, which could be an application, platform, or infrastructure team. The first action is to locate all instances of this translator, confirm their network exposure and business criticality, and then identify the accountable owner to plan remediation.

Application or platform team owns resolution.
Verify API exposure and business criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is manga-image-translator and its shared API mode?

Manga-image-translator is a tool designed to automate the translation of text within comic book images. The shared API mode is a specific deployment configuration that exposes FastAPI endpoints, allowing the application to act as a backend service for processing image translation requests over a network.

What does unsafe deserialization mean for CVE-2026-26215?

This vulnerability, classified as CWE-502, occurs when an application reconstructs data from an untrusted source without proper checks. In this case, the software uses the 'pickle' module to process incoming request bodies. Because pickle can execute arbitrary commands during deserialization, a specially crafted input allows an attacker to run unauthorized code directly on the server hosting the translator.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a malicious payload to the /simple_execute/ or /execute/ API endpoints. While the application includes a nonce-based authorization check to limit access, this check is ineffective by default because the expected nonce is an empty string. Therefore, no special credentials or prior authentication are required to execute the attack.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is highly relevant if your instance is deployed in shared API mode and reachable via a network. Because these services are often intentionally exposed to handle image processing requests from external sources, they frequently exist in network-accessible configurations that increase the likelihood of unauthorized reachability.

What should I do first to manage this risk?

Start by auditing your infrastructure to identify all active instances of the manga-image-translator software. Verify whether these instances are configured to run in shared API mode and assess their network accessibility. Once identified, work with the service owners to isolate these endpoints or restrict access until a formal update or configuration change is applied to secure the deserialization process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.