The manga-image-translator product by zyddnys, specifically version 0 and earlier, contains a critical deserialization vulnerability (CWE-502) in its shared API mode. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize request bodies using Python's pickle.loads() without validation. Although a nonce-based authorization mechanism is implemented, it defaults to an empty string and is effectively bypassed, allowing unauthenticated remote code execution by sending crafted pickle payloads. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can execute arbitrary code on the server hosting manga-image-translator by sending a specially crafted pickle payload to vulnerable FastAPI endpoints. This leads to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects all users running version 0 and prior in shared API mode.

No official patch or fix is currently available for this vulnerability. Users should avoid exposing the vulnerable endpoints to untrusted networks and disable shared API mode if possible. Monitor the vendor's advisory channels for updates or official fixes. Until a patch is released, do not send untrusted data to the affected endpoints.