BBC-Esq/VectorDB-Plugin

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 130
Likely real: Yes, 99% confidence

the `encoding` argument to Popen is only available on Python 3.6+

process = subprocess.Popen(
        cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        text=True,
        encoding="utf-8",
        errors="replace",
        bufsize=1,
        cwd=str(PROJECT_ROOT),
        env={**os.environ, "PYTHONUNBUFFERED": "1", "PYTHONIOENCODING": "utf-8"},
    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 130
Likely real: Yes, 99% confidence

the `errors` argument to Popen is only available on Python 3.6+

process = subprocess.Popen(
        cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        text=True,
        encoding="utf-8",
        errors="replace",
        bufsize=1,
        cwd=str(PROJECT_ROOT),
        env={**os.environ, "PYTHONUNBUFFERED": "1", "PYTHONIOENCODING": "utf-8"},
    )

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /setup_windows.py line 122
Likely real: Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]

[sys.executable, "-m", "pip", "install", "--upgrade", "pip", "--no-cache-dir"],
        [sys.executable, "-m", "pip", "install", "--upgrade", "...

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /setup_windows.py line 121
Likely real: Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]

upgrade_commands = [
        [sys.executable, "-m", "pip", "install", "--upgrade", "pip", "--no-cache-dir"],
        [sys.executable, "-m", "pip", "install", "--upgrade", "...

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /setup_windows.py line 201
Likely real: Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]

print("Installing uv:")
subprocess.run(["pip", "install", "uv"], check=True)

print("\nInstalling priority libraries:")

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /modules/process_images.py line 202
Likely real: Yes, 91% confidence

Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography]

model.eval()
        self.model_dtype = dtype
        my_cprint(f"{chosen_model} loaded into memory on {device_str} ({precision_str})", "green")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /setup_windows.py line 20
Likely real: Yes, 55% confidence

Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

subprocess.run(f'rmdir /S /Q "{cache_dir}"', shell=True, check=False)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /modules/kokoro.py line 69
Likely real: Yes, 51% confidence

Functions reliant on pickle can result in arbitrary code execution. Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX

self.voicepack_cache[voice_name] = torch.load(str(voicepack_path), weights_only=True).to(device)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 20
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

19     print(f"\nRemoving Triton cache at {cache_dir} via OS command…")
20     subprocess.run(f'rmdir /S /Q "{cache_dir}"', shell=True, check=False)
21     print("Triton cache removed.\n")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/check_packages.py line 665
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

with urllib.request.urlopen(url, timeout=10) as response:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/check_packages.py line 467
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

with urllib.request.urlopen(url, timeout=10) as response:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/check_packages.py line 69
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

with urllib.request.urlopen(url, timeout=10) as response:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/check_packages.py line 22
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

with urllib.request.urlopen(url, timeout=10) as response:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 669
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(
                        {"texts": chunk_texts[bstart:bend], "metadatas": all_metadatas[bstart:bend]},
                        f, protocol=pickle.HIGHEST_PROTOCOL,
                    )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/create_symlinks.py line 33
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

32             return False, None
33         suffix_hash = hashlib.md5(str(source).encode("utf-8")).hexdigest()[:8]
34         disambiguated = target / f"{source.stem}_{suffix_hash}{source.suffix}"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/scraper.py line 802
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

801                 + "_"
802                 + hashlib.md5(original_url.encode()).hexdigest()[:8]
803             )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 22
Likely real: Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

21     try:
22         with urllib.request.urlopen(url, timeout=10) as response:
23             if response.status != 200:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 69
Likely real: Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

68         try:
69             with urllib.request.urlopen(url, timeout=10) as response:
70                 if response.status != 200:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 467
Likely real: Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

466             url = f"https://pypi.org/pypi/{package_name}/json"
467             with urllib.request.urlopen(url, timeout=10) as response:
468                 if response.status != 200:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 665
Likely real: Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

664         try:
665             with urllib.request.urlopen(url, timeout=10) as response:
666                 if response.status != 200:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 239
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(chunk_texts, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_write.py line 217
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(hash_id_mappings, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_write.py line 148
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

shard = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 536
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(output, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 400
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(output, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 357
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

_loaded = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 260
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

worker_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 177
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(data, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_split.py line 285
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump({"texts": [], "chunks": []}, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 540
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

doc_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 573
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(doc_data, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 590
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

split_output = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/database_interactions.py line 687
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

hash_id_mappings = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/embedding_models.py line 234
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

attempt_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/embedding_models.py line 245
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

attempt_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/embedding_models.py line 438
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(texts, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_extract.py line 46
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(doc_data, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_split.py line 153
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(chunk_docs, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_split.py line 173
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

worker_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_split.py line 258
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

doc_data = pickle.load(f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /db/stage_split.py line 367
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(output_data, f, protocol=pickle.HIGHEST_PROTOCOL)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/check_packages.py line 341
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

package = importlib.import_module(pkg_name)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /chat/base.py line 470
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

model_class = globals()[model_class_name]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /modules/process_images.py line 84
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

loader_class = globals()[loader_name]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_split.py line 258
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

257     with open(args.input_pickle, "rb") as f:
258         doc_data = pickle.load(f)
259

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/database_interactions.py line 590
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

589             with open(chunks_pkl, "rb") as f:
590                 split_output = pickle.load(f)
591

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/database_interactions.py line 540
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

539             with open(extracted_pkl, "rb") as f:
540                 doc_data = pickle.load(f)
541             logger.info(f"Extracted {len(doc_data)} documents")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/database_interactions.py line 687
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

686                 with open(write_data_dir / "hash_id_mappings.pkl", "rb") as f:
687                     hash_id_mappings = pickle.load(f)
688             except Exception as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/embedding_models.py line 234
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

233             with open(attempt_output, "rb") as f:
234                 attempt_data = pickle.load(f)
235             try:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/embedding_models.py line 245
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

244                 with open(checkpoint_path, "rb") as f:
245                     attempt_data = pickle.load(f)
246                 try:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_split.py line 173
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

172                 with open(result_pkl, "rb") as f:
173                     worker_data = pickle.load(f)
174                 texts = worker_data.get("texts", [])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 260
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

259                 with open(result_pkl, "rb") as f:
260                     worker_data = pickle.load(f)
261                 batches = worker_data.get("batches", [])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_write.py line 148
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

147         with open(data_dir / f"shard_{batch_idx:05d}.pkl", "rb") as f:
148             shard = pickle.load(f)
149         batch_texts_list = shard["texts"]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 357
Likely real: Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

356     with open(args.input_pickle, "rb") as f:
357         _loaded = pickle.load(f)
358     if isinstance(_loaded, dict):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 137
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in snapshot_download()

136                         try:
137                             download_path = snapshot_download(
138                                 repo_id="2Noise/ChatTTS",
139                                 allow_patterns=["*.yaml", "*.json", "*.safetensors", "spk_stat.pt", "tokenizer.pt"],
140                                 cache_dir=custom_path,
141                                 force_download=force_redownload,
142                             )
143                         except:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 366
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in snapshot_download()

365         print(f"Downloading Kokoro TTS model from {repo_id}...")
366         snapshot_download(
367             repo_id=repo_id,
368             local_dir=str(tts_path),
369             max_workers=4,
370             token=False
371         )
372         print("Kokoro TTS model downloaded successfully")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/download_model.py line 219
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in snapshot_download()

218                 download_kwargs["token"] = False
219             snapshot_download(**download_kwargs)
220             print("\033[92mModel downloaded and ready to use.\033[0m")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/ocr.py line 272
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in hf_hub_download()

271             import yaml
272             yml = hf_hub_download("PaddlePaddle/PP-OCRv6_small_rec_onnx", "inference.yml")
273             chars = yaml.safe_load(Path(yml).read_text(encoding="utf-8"))["PostProcess"]["character_dict"]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/ocr.py line 278
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in hf_hub_download()

277         print(f"\033[92m[RapidOCR] fetching {name} from HuggingFace {repo}\033[0m")
278         src = hf_hub_download(repo, fn)
279         p.write_bytes(Path(src).read_bytes())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/tts.py line 601
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in hf_hub_download()

600 
601             config_path = hf_hub_download(
602                 repo_id=hf_repo, filename="config.json",
603                 cache_dir=CACHE_DIR, token=False,
604             )
605             with open(config_path, 'r') as f:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/tts.py line 618
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in hf_hub_download()

617                 try:
618                     hf_hub_download(repo_id=hf_repo, filename=filename, cache_dir=CACHE_DIR, token=False, local_files_only=True)
619                 except Exception:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/tts.py line 629
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in hf_hub_download()

628                 try:
629                     file_path = hf_hub_download(
630                         repo_id=hf_repo,
631                         filename=filename,
632                         cache_dir=CACHE_DIR,
633                         token=False
634                     )
635                     downloaded_paths[filename] = file_path

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 104
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in snapshot_download()

103                 elif cache_dir:
104                     download_path = snapshot_download(
105                         repo_id="2Noise/ChatTTS",
106                         allow_patterns=["*.yaml", "*.json", "*.safetensors", "spk_stat.pt", "tokenizer.pt"],
107                         cache_dir=cache_dir,
108                         force_download=force_redownload
109                     )
110                     if not check_all_assets(Path(download_path), self.sha256_map, update=False):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 94
Likely real: Probably noise, 19% confidence

Unsafe Hugging Face Hub download without revision pinning in snapshot_download()

93                 if local_dir:
94                     download_path = snapshot_download(
95                         repo_id="2Noise/ChatTTS",
96                         allow_patterns=["*.yaml", "*.json", "*.safetensors", "spk_stat.pt", "tokenizer.pt"],
97                         local_dir=local_dir,
98                         force_download=force_redownload
99                     )
100                     if not check_all_assets(Path(download_path), self.sha256_map, update=False):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/build_user_manual_db.py line 82
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

81         from transformers import AutoTokenizer
82         tokenizer = AutoTokenizer.from_pretrained(str(BGE_MODEL))
83         measure = lambda text: len(tokenizer.encode(text, add_special_tokens=True))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /chat/base.py line 209
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

208         with utf8_file_operations():
209             self.tokenizer = AutoTokenizer.from_pretrained(model_info['repo_id'], **tokenizer_settings)
210

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /chat/base.py line 226
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

225 
226         self.model = AutoModelForCausalLM.from_pretrained(model_info['repo_id'], **model_settings)
227         self.model.eval()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 164
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

163 
164         processor = AutoProcessor.from_pretrained(
165             model_id,
166             use_fast=True,
167             cache_dir=cache_dir,
168             token=False,
169         )
170

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 179
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

178             )
179             model = AutoModelForImageTextToText.from_pretrained(
180                 model_id,
181                 quantization_config=quantization_config,
182                 torch_dtype=dtype,
183                 low_cpu_mem_usage=True,
184                 cache_dir=cache_dir,
185                 token=False,
186                 device_map="auto",
187             )
188             device_str = "CUDA"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 192
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

191             precision_str = "float32"
192             model = AutoModelForImageTextToText.from_pretrained(
193                 model_id,
194                 torch_dtype=dtype,
195                 low_cpu_mem_usage=True,
196                 cache_dir=cache_dir,
197                 token=False,
198                 device_map={"": "cpu"},
199             )
200             device_str = "CPU"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 252
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

251 
252         processor = AutoProcessor.from_pretrained(
253             model_id,
254             use_fast=True,
255             cache_dir=cache_dir,
256             token=False
257         )
258

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 327
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

326 
327             model = AutoModelForVision2Seq.from_pretrained(
328                 model_id,
329                 quantization_config=quant_cfg,
330                 torch_dtype=dtype,
331                 low_cpu_mem_usage=True,
332                 cache_dir=cache_dir,
333                 token=False,
334                 device_map="auto"
335             )
336             my_cprint(f"{chosen_model} loaded into memory on CUDA ({precision_str})", "green")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 339
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

338         else:
339             model = AutoModelForVision2Seq.from_pretrained(
340                 model_id,
341                 torch_dtype=torch.float32,
342                 low_cpu_mem_usage=True,
343                 cache_dir=cache_dir,
344                 token=False,
345                 device_map={"": "cpu"}
346             )
347             my_cprint(f"{chosen_model} loaded into memory on CPU (float32)", "green")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 432
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

431 
432         processor = AutoProcessor.from_pretrained(
433             model_id,
434             use_fast=True,
435             min_pixels=28*28,
436             max_pixels=1280*28*28,
437             cache_dir=cache_dir,
438             token=False
439         )
440

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 441
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

440 
441         model = AutoModelForImageTextToText.from_pretrained(
442             model_id,
443             quantization_config=quantization_config,
444             torch_dtype=dtype,
445             low_cpu_mem_usage=True,
446             cache_dir=cache_dir,
447             token=False,
448             device_map="auto",
449         )
450         model.eval()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 541
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

540 
541         model = AutoModelForImageTextToText.from_pretrained(
542             source,
543             torch_dtype=dtype,
544             cache_dir=cache_dir,
545             device_map=device_map,
546         ).eval()
547

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/process_images.py line 548
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

547 
548         processor = AutoProcessor.from_pretrained(
549             source,
550             cache_dir=cache_dir,
551         )
552

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/tts.py line 232
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

231         
232         self.processor = AutoProcessor.from_pretrained(repository_id, token=False, cache_dir=CACHE_DIR)
233

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /modules/tts.py line 234
Likely real: Probably noise, 17% confidence

Unsafe Hugging Face Hub download without revision pinning in from_pretrained()

233         
234         self.model = BarkModel.from_pretrained(
235             repository_id,
236             torch_dtype=torch.float16,
237             cache_dir=CACHE_DIR,
238             token=False
239         ).to(self.device)
240

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/embedding_models.py line 401
Likely real: Yes, 95% confidence

Possible hardcoded password: '[PAD]'

400                 else:
401                     self.tokenizer.add_special_tokens({"pad_token": "[PAD]"})
402

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /db/database_interactions.py line 278
Likely real: Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]

os.environ["TOKENIZERS_PARALLELISM"] = "false"
    os.environ["RUST_BACKTRACE"] = "1"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 313
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

312                 temp_path = tmp.name
313             os.startfile(temp_path)
314

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 752
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

751         if platform.system() == "Windows":
752             os.startfile(file_path)
753         elif platform.system() == "Darwin":

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 416
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

415         if system == "Windows":
416             os.startfile(folder_path)
417         elif system == "Darwin":

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/vision.py line 488
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

487         try:
488             os.startfile(file_path)
489         except Exception as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 94
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

93 def install_packages(packages: list[tuple[str, str]], no_deps: bool = True) -> bool:
94     import subprocess
95     import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 6
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

5 import json
6 import subprocess
7 from PySide6.QtWidgets import (

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_databases/create.py line 7
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

6 import shutil
7 import subprocess
8 from pathlib import Path

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/vision.py line 3
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

2 import textwrap
3 import subprocess
4 from pathlib import Path

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/subprocess_utils.py line 2
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

1 import logging
2 import subprocess
3 import threading

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/database_interactions.py line 62
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

61 import shutil
62 import subprocess
63 import tempfile

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 159
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

158 def has_nvidia_gpu():
159     import subprocess
160

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 25
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

24 
25 import subprocess
26 import time

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 2
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

1 import os
2 import subprocess
3 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 4
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

3 import shutil
4 import subprocess
5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/metrics_bar.py line 8
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

7 import csv
8 import subprocess
9 import psutil

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import pickle
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_split.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import pickle
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/embedding_models.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import shutil
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 12
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

11 import psutil
12 import subprocess
13 import re

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 201
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

200 print("Installing uv:")
201 subprocess.run(["pip", "install", "uv"], check=True)
202

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 420
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

419         else:
420             subprocess.Popen(["xdg-open", folder_path])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 162
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

161     try:
162         result = subprocess.run(
163             ["nvidia-smi"],
164             stdout=subprocess.PIPE,
165             stderr=subprocess.PIPE
166         )
167         return result.returncode == 0

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 754
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

753         elif platform.system() == "Darwin":
754             subprocess.Popen(["open", file_path])
755         else:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 756
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

755         else:
756             subprocess.Popen(["xdg-open", file_path])
757     except OSError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/metrics_bar.py line 35
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

34     try:
35         subprocess.check_output(["nvidia-smi"], stderr=subprocess.STDOUT)
36         return True

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 418
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

417         elif system == "Darwin":
418             subprocess.Popen(["open", folder_path])
419         else:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 43
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

42     try:
43         result = subprocess.run(
44             ["nvidia-smi"],
45             stdout=subprocess.PIPE,
46             stderr=subprocess.PIPE
47         )
48         return result.returncode == 0

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 88
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

87     try:
88         subprocess.check_output(["nvidia-smi"])
89         return True

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/metrics_bar.py line 35
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

34     try:
35         subprocess.check_output(["nvidia-smi"], stderr=subprocess.STDOUT)
36         return True

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 420
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

419         else:
420             subprocess.Popen(["xdg-open", folder_path])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_tokenize.py line 203
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

202     t0 = time.time()
203     with subprocess.Popen(
204         cmd,
205         stdout=subprocess.PIPE,
206         stderr=subprocess.STDOUT,
207         text=True,
208         bufsize=1,
209         env={**os.environ, "PYTHONUNBUFFERED": "1"},
210     ) as process:
211         from db.subprocess_utils import drain_subprocess

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/stage_split.py line 116
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

115     t0 = time.time()
116     with subprocess.Popen(
117         cmd,
118         stdout=subprocess.PIPE,
119         stderr=subprocess.STDOUT,
120         text=True,
121         bufsize=1,
122         env={**os.environ, "PYTHONUNBUFFERED": "1", "VECTORDB_PROJECT_ROOT": project_root},
123     ) as process:
124         from db.subprocess_utils import drain_subprocess

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/embedding_models.py line 160
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

159 
160     process = subprocess.Popen(
161         cmd,
162         stdout=subprocess.PIPE,
163         stderr=subprocess.STDOUT,
164         text=True,
165         bufsize=1,
166         cwd=str(cwd),
167         env={**os.environ, "PYTHONUNBUFFERED": "1"},
168     )
169

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /db/database_interactions.py line 130
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

129 
130     process = subprocess.Popen(
131         cmd,
132         stdout=subprocess.PIPE,
133         stderr=subprocess.STDOUT,
134         text=True,
135         encoding="utf-8",
136         errors="replace",
137         bufsize=1,
138         cwd=str(PROJECT_ROOT),
139         env={**os.environ, "PYTHONUNBUFFERED": "1", "PYTHONIOENCODING": "utf-8"},
140     )
141

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 756
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

755         else:
756             subprocess.Popen(["xdg-open", file_path])
757     except OSError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 754
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

753         elif platform.system() == "Darwin":
754             subprocess.Popen(["open", file_path])
755         else:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 162
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

161     try:
162         result = subprocess.run(
163             ["nvidia-smi"],
164             stdout=subprocess.PIPE,
165             stderr=subprocess.PIPE
166         )
167         return result.returncode == 0

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /core/utilities.py line 104
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

103                 
104             result = subprocess.run(command, capture_output=True, text=True, check=True)
105             my_cprint(f"Successfully installed {package}=={version}", "green")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_databases/create.py line 53
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

52 
53             self._process = subprocess.Popen(
54                 cmd,
55                 stdout=subprocess.PIPE,
56                 stderr=subprocess.STDOUT,
57                 text=True,
58                 bufsize=1,
59                 cwd=str(PROJECT_ROOT),
60                 env=env,
61             )
62

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /gui/tabs_tools/scrape.py line 418
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

417         elif system == "Darwin":
418             subprocess.Popen(["open", folder_path])
419         else:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 43
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

42     try:
43         result = subprocess.run(
44             ["nvidia-smi"],
45             stdout=subprocess.PIPE,
46             stderr=subprocess.PIPE
47         )
48         return result.returncode == 0

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 88
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

87     try:
88         subprocess.check_output(["nvidia-smi"])
89         return True

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 131
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

130                 print(f"\nAttempt {attempt + 1} of {max_retries}: Upgrading {package}...")
131                 subprocess.run(command, check=True, capture_output=True, text=True, timeout=480)
132                 print(f"\033[92mSuccessfully upgraded {package}\033[0m")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 157
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

156             print(f"\nAttempt {attempt + 1} of {max_retries}: Installing {library}{' with dependencies' if with_deps else ''}")
157             subprocess.run(pip_args, check=True, capture_output=True, text=True, timeout=600)
158             print(f"\033[92mSuccessfully installed {library}{' with dependencies' if with_deps else ''}\033[0m")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup_windows.py line 201
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

200 print("Installing uv:")
201 subprocess.run(["pip", "install", "uv"], check=True)
202

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 98
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

97             command = [sys.executable, "-m", "pip", "install", f"{self.package_name}=={self.selected_version}", "--no-deps"]
98             process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
99             stdout, stderr = process.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 117
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

116                 command = [sys.executable, "-m", "pip", "install", f"{package}=={version_installed}", "--no-deps"]
117                 process = subprocess.run(command, capture_output=True, text=True)
118                 if process.returncode != 0:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /tools/check_packages.py line 515
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

514             command = ["pipdeptree", "--reverse", "--packages", package_name, "--depth", "1"]
515             process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
516             stdout, stderr = process.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 352
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

351         )
352         assert vocos_ckpt_path, "vocos_ckpt_path should not be None"
353         vocos.load_state_dict(load_safetensors(vocos_ckpt_path))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 368
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

367         coef = str(dvae)
368         assert dvae_ckpt_path, "dvae_ckpt_path should not be None"
369         dvae.load_pretrained(dvae_ckpt_path, dvae_device)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 392
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

391         ).eval()
392         assert gpt_ckpt_path, "gpt_ckpt_path should not be None"
393         gpt.load_pretrained(gpt_ckpt_path, embed_path, experimental=experimental)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 410
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

409         coef = str(decoder)
410         assert decoder_ckpt_path, "decoder_ckpt_path should not be None"
411         decoder.load_pretrained(decoder_ckpt_path, device)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 439
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

438 
439         assert self.has_loaded(use_decoder=use_decoder)
440

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 488
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

487             result.destroy()
488             assert len(wavs), 1
489             params_infer_code.spk_smp = self.sample_audio_speaker(wavs[0])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Assets/core.py line 593
Likely real: Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

592 
593         assert len(text), "text should not be empty"
594

BBC-Esq / VectorDB-Plugin

What we found, in plain English

Detections by engine

Score over time

Findings