CVE-2026-10042 is a critical vulnerability in the manga-image-translator project by zyddnys. It arises from unsafe deserialization of untrusted data using Python's pickle module in the share.py component. The endpoints /execute/{method_name} and /simple_execute/{method_name} accept HTTP request bodies that are deserialized without validation, enabling remote attackers to supply crafted pickle payloads that execute arbitrary code within the server process. When deployed in Docker containers running as root, this leads to full container compromise. The CVSS v3.1 score is 9.8, reflecting the high impact and ease of exploitation. No patch or official remediation is currently documented, and no known exploits in the wild have been reported.

Successful exploitation results in remote code execution with no authentication required, allowing attackers to run arbitrary code on the server hosting manga-image-translator. This can lead to complete compromise of the container environment, especially when running with root privileges in Docker. Confidentiality, integrity, and availability of the affected system are fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoints to untrusted networks. Consider disabling or restricting access to the /execute/{method_name} and /simple_execute/{method_name} endpoints. Running the container with least privilege (non-root user) may reduce impact but does not eliminate the vulnerability. Monitor vendor channels for updates and apply patches promptly once released.