CVE-2026-10042 is a critical vulnerability in the manga-image-translator product by zyddnys. It arises from unsafe deserialization of untrusted data using Python's pickle.loads() in the share.py module. The vulnerable endpoints /execute/{method_name} and /simple_execute/{method_name} accept HTTP request bodies that are deserialized without validation, enabling remote attackers to supply crafted pickle payloads. Successful exploitation results in remote code execution within the server process and full compromise of the container, especially when running as root in Docker. The vulnerability is identified as CWE-502 (Deserialization of Untrusted Data) and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patches or vendor advisories are currently available, and no known exploits in the wild have been reported.

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server hosting the manga-image-translator application. The impact includes complete compromise of the container environment, potentially leading to full system control if the container runs with root privileges. Confidentiality, integrity, and availability of the affected system are all severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid exposing the vulnerable endpoints to untrusted networks. Running the container with least privilege (not as root) may reduce impact but does not eliminate the risk. Monitor official channels for updates or patches from the vendor.