The vulnerability resides in the share.py module of manga-image-translator, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize HTTP request bodies using pickle.loads() without validating the input. An attacker can craft a malicious pickle payload that, when loaded, executes arbitrary code in the server process, leading to remote code execution and full container compromise when the application runs as root in the default Docker deployment.

The affected product is manga-image-translator developed by zyddnys. Any installation that enables the shared API server mode and exposes the /execute or /simple_execute endpoints is vulnerable; the description does not list specific version numbers, so all current releases before the fix commit are at risk.

The CVSS base score of 9.2 indicates a critical severity. While the EPSS score is unavailable, the vulnerability remains unlisted in CISA KEV. The likely attack vector is remote, via crafted HTTP requests containing a malicious pickle payload; exploitation would grant an attacker full code execution and container takeover on systems running the default Docker configuration as root.