The manga-image-translator product by zyddnys, specifically version beta-0.3 and prior, contains a CWE-502 vulnerability due to unsafe deserialization of untrusted data. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize request bodies using Python's pickle.loads() without validating the input. Although a nonce-based authorization mechanism is implemented, it defaults to an empty string and effectively disables the check, allowing remote attackers to send crafted pickle payloads that execute arbitrary code on the server without authentication.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting manga-image-translator, potentially leading to full system compromise. The vulnerability does not require user interaction or privileges, making it highly severe and critical for affected deployments.

No official patch or fix is currently available for this vulnerability. Users should avoid running affected versions of manga-image-translator in shared API mode until a fix is released. Restricting network access to the vulnerable endpoints and disabling or isolating the affected API functionality may reduce exposure. Monitor the vendor's advisory channels for updates and apply official patches once available.