Leaderboard github.com
Comfy-Org/ComfyUI
The most powerful and modular diffusion model GUI, api and backend with a graph/nodes interface. The fastest local inference engine in the world.
AI provenance
<1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
59/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
55/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts66%
- Estimated AI-generated share0%
- AI tool configuration files1
- Work sessions at AI pace28
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.15
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 25 | 3,643 | 2026-01-09 | 2026-11-08 |
| OpenAI Codex | 1 | 1,899 | 2026-09-01 | 2026-09-01 |
| Cursor agent | 6 | 67 | 2026-05-05 | 2026-05-25 |
| GitHub Copilot coding agent | 1 | 0 | 2026-02-11 | 2026-02-11 |
Lines added per month all AI-attributed share
- 2023-0129,075 · 0% AI
- 2023-024,553 · 0% AI
- 2023-0321,015 · 0% AI
- 2023-047,897 · 0% AI
- 2023-055,413 · 0% AI
- 2023-063,248 · 0% AI
- 2023-072,540 · 0% AI
- 2023-083,423 · 0% AI
- 2023-093,930 · 0% AI
- 2023-103,783 · 0% AI
- 2023-116,197 · 0% AI
- 2023-123,145 · 0% AI
- 2024-013,542 · 0% AI
- 2024-022,170 · 0% AI
- 2024-031,457 · 0% AI
- 2024-041,243 · 0% AI
- 2024-05905 · 0% AI
- 2024-068,830 · 0% AI
- 2024-073,297 · 0% AI
- 2024-08230,106 · 0% AI
- 2024-09119,183 · 0% AI
- 2024-10252,718 · 0% AI
- 2024-11138,001 · 0% AI
- 2024-1297,815 · 0% AI
- 2025-01349,133 · 0% AI
- 2025-0213,834 · 0% AI
- 2025-033,632 · 0% AI
- 2025-045,856 · 0% AI
- 2025-0528,879 · 0% AI
- 2025-064,326 · 0% AI
- 2025-0710,658 · 0% AI
- 2025-0811,498 · 0% AI
- 2025-0912,378 · 0% AI
- 2025-1015,135 · 0% AI
- 2025-119,026 · 0% AI
- 2025-1210,530 · 0% AI
- 2026-0123,154 · 0% AI
- 2026-0213,985 · 0% AI
- 2026-0322,424 · 12% AI
- 2026-0411,000 · 0% AI
- 2026-0526,914 · 0% AI
- 2026-0623,692 · 0% AI
- 2026-0718,793 · 0% AI
- 2026-0845,169 · 0% AI
- 2026-0952,383 · 4% AI
- 2026-1029,611 · 0% AI
- 2026-119,459 · 4% AI
Findings in AI-attributed lines vs the rest
From git blame: 2,373 lines trace to AI-attributed commits, 290,364 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.42 | 0.69 | 0.61× |
| Security | 0.00 | 0.10 | 0.00× |
Evidence by analyzer
Explicit AI attributionok29 items
- Claude Code: 25 attributed commits, 3,643 lines added
- Cursor agent: 6 attributed commits, 67 lines added
- GitHub Copilot coding agent: 1 attributed commits, 0 lines added
- OpenAI Codex: 1 attributed commits, 1,899 lines added
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- OpenAI Codex: PR branch 'codex/support-sensenova-u15'
- Claude Code: author claude[bot]
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Cursor agent: PR branch 'cursor/emit-hash-on-asset-responses-a601'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Cursor agent: PR branch 'cursor/add-description-to-workspace-api-key-schemas-275d'
- Cursor agent: PR branch 'cursor/mark-deprecated-cloud-endpoints-e81e'
- Cursor agent: PR branch 'cursor/add-experiment-nodes-schema-endpoints-5a86'
- Cursor agent: PR branch 'cursor/cloud-fe-endpoints-6010'
- Cursor agent: PR branch 'cursor/oss-spec-cloud-fields-1c03'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- attributed_commit_share
- 0.5%
- attributed_commits
- 33
- attributed_loc
- 5,609
- attributed_loc_share
- 0.3%
- commits
- 6,098
- effective_loc
- 1,704,955
- tools_detected
- 4
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-06-30
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok15 items
- 217,390 lines of first-party code in ~4.0h (54,348 lines/hour, 1 commit session)
- 95,433 lines of first-party code in ~4.0h (23,858 lines/hour, 1 commit session)
- 89,967 lines of first-party code in ~4.0h (22,492 lines/hour, 1 commit session)
- 85,570 lines of first-party code in ~4.0h (21,392 lines/hour, 1 commit session)
- 82,184 lines of first-party code in ~4.0h (20,546 lines/hour, 1 commit session)
- 77,057 lines of first-party code in ~4.0h (19,264 lines/hour, 1 commit session)
- 71,457 lines of first-party code in ~4.0h (17,864 lines/hour, 1 commit session)
- 67,321 lines of first-party code in ~4.0h (16,830 lines/hour, 1 commit session)
- 61,183 lines of first-party code in ~4.0h (15,248 lines/hour, 2 commit session)
- 57,220 lines of first-party code in ~4.0h (14,305 lines/hour, 1 commit session)
- 54,469 lines of first-party code in ~4.0h (13,617 lines/hour, 1 commit session)
- 53,623 lines of first-party code in ~4.0h (13,406 lines/hour, 1 commit session)
- 31,837 lines of first-party code in ~4.0h (7,959 lines/hour, 1 commit session)
- 14,404 lines of first-party code in ~4.3h (3,311 lines/hour, 3 commit session)
- 12,389 lines of first-party code in ~4.0h (3,097 lines/hour, 1 commit session)
- excluded_import_loc
- 154,305
- flagged_loc
- 1,122,645
- flagged_loc_share
- 72.8%
- flagged_units
- 28
- max_loc_per_hour
- 54,347.50
- measured_loc
- 1,541,184
- median_loc_per_hour
- 35.90
- pr_timed_units
- 1,469
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 4,379
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 2,310.30
- releases
- 99
Coding styleok8 items
- step-by-step narration comment: # first, replace node id (class_type)
- step-by-step narration comment: # now we are in the inner dict - "pooled_output" is a tensor, "control" is a ControlBase object, "model_conds" is dictio
- step-by-step narration comment: # first, obtain uniform windows as normal, looping and all
- step-by-step narration comment: # first, apply lora_hook to conditioning, if provided
- step-by-step narration comment: # next, apply mask to conditioning
- step-by-step narration comment: # finally, apply mask to conditioning and store
- step-by-step narration comment: # first, apply lora_hook to new conditioning, if provided
- step-by-step narration comment: # next, apply mask to new conditioning, if provided
- count:assistant_voice
- 0
- count:emoji_in_code
- 13
- count:narrated_steps
- 39
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 14
- files:placeholder
- 0
- index
- 0.15
- lines_scanned
- 292,737
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.04
- per_kloc:narrated_steps
- 0.13
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 2,373
- blame_failures
- 0
- files_blamed
- 781
- other_lines
- 290,364
- quality:ai_findings
- 1
- quality:ai_per_kloc
- 0.42
- quality:other_findings
- 199
- quality:other_per_kloc
- 0.69
- quality:ratio
- 0.61
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 30
- security:other_per_kloc
- 0.10
- security:ratio
- 0
Code quality
59 weak
Code quality is weak: test-to-source ratio 0.19, CI runs tests; 19% of function code in complex or long functions; 12% duplicated lines. Weakest area: lint.
How the score is built
- Complexity56
- Duplication49
- Lint and smells22
- Tests and CI84
- Documentation80
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- detect_unet_config in comfy/model_detection.py: complexity 242, 1163 lines
- __init__ in comfy/sd.py: complexity 133, 611 lines
- _save_transcoded in comfy_api/latest/_input_impl/video_types.py: complexity 119, 291 lines
- load_text_encoder_state_dicts in comfy/sd.py: complexity 112, 354 lines
- model_lora_keys_unet in comfy/lora.py: complexity 104, 202 lines
- _request_base in comfy_api_nodes/util/client.py: complexity 98, 354 lines
- draw_wholebody_keypoints in comfy_extras/pose/keypoint_draw.py: complexity 89, 138 lines
- forward in comfy/text_encoders/gemma4.py: complexity 87, 161 lines
- save_glb in comfy_extras/nodes_save_3d.py: complexity 82, 302 lines
- _validate_payload in app/governance.py: complexity 70, 89 lines
- complex_functions
- 322
- function_nloc
- 204,411
- functions
- 12,753
- long_functions
- 164
- many_param_functions
- 1,178
- mean_ccn
- 3.32
- p90_ccn
- 7
- risky_nloc_share
- 19.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: alembic_db/versions/0001_assets.py:19 and alembic_db/versions/0007_record_content_split.py:95
- 6+ duplicated lines: alembic_db/versions/0001_assets.py:32 and alembic_db/versions/0002_merge_to_asset_references.py:212
- 6+ duplicated lines: alembic_db/versions/0005_allow_case_sensitive_tags.py:32 and alembic_db/versions/0005_allow_case_sensitive_tags.py:98
- 6+ duplicated lines: alembic_db/versions/0007_record_content_split.py:70 and alembic_db/versions/0008_drop_asset_meta.py:26
- 6+ duplicated lines: app/assets/api/routes.py:451 and app/assets/api/routes.py:994
- 6+ duplicated lines: app/assets/api/schemas_in.py:60 and app/assets/api/schemas_in.py:152
- 6+ duplicated lines: app/assets/database/queries/tags.py:107 and app/assets/services/tagging.py:146
- 6+ duplicated lines: app/assets/manager.py:54 and app/assets/manager.py:121
- 6+ duplicated lines: app/assets/scanner.py:359 and app/assets/scanner.py:494
- 6+ duplicated lines: app/assets/scanner_changes.py:58 and app/assets/scanner_changes.py:152
- compared_lines
- 231,006
- duplicated_lines
- 27,463
- duplicated_share
- 11.9%
- files
- 781
Lintok
- category:best-practice
- 36
- category:correctness
- 889
- category:maintainability
- 306
- findings
- 1,231
- scanned_lines
- 292,737
- weighted_findings
- 1,747.75
Tests and CIok12 items
- CI config: .github/workflows/api-node-template.yml
.github/workflows/api-node-template.yml - CI config: .github/workflows/backport_release.yaml
.github/workflows/backport_release.yaml - CI config: .github/workflows/check-ai-co-authors.yml
.github/workflows/check-ai-co-authors.yml - CI config: .github/workflows/check-line-endings.yml
.github/workflows/check-line-endings.yml - CI config: .github/workflows/ci-cursor-review.yml
.github/workflows/ci-cursor-review.yml - CI config: .github/workflows/cla.yml
.github/workflows/cla.yml - CI config: .github/workflows/detect-unreviewed-merge.yml
.github/workflows/detect-unreviewed-merge.yml - CI config: .github/workflows/notify-on-merge.yml
.github/workflows/notify-on-merge.yml - CI config: .github/workflows/openapi-lint.yml
.github/workflows/openapi-lint.yml - CI config: .github/workflows/pullrequest-ci-run.yml
.github/workflows/pullrequest-ci-run.yml - CI runs tests (pytest)
- CI runs linters (ruff, pylint, pyright)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 29
- cochange_commits
- 239
- cochange_share
- 29.7%
- source_lines
- 292,737
- test_lines
- 54,893
- test_ratio
- 0.19
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 284
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 406
- escapes_per_kloc
- 1.39
Security
55 weak
Security posture is weak: 119 known vulnerabilities in 6 dependencies; 6 high-severity SAST findings; 141 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets69
- Static analysis (SAST)98
- Vulnerable dependencies33
- CI workflows0
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 39
- declared
- 39
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 8
- secrets_nonprod
- 3
Static analysis (opengrep)ok
- findings
- 28
- findings_high
- 6
- findings_low
- 0
- findings_medium
- 22
- parse_errors
- 2
- scanned_lines
- 292,737
- weighted_findings
- 15.75
Dependencies (osv-scanner)ok
- penalty
- 66
- vulnerabilities
- 119
- vulnerable_packages
- 6
- vulns_critical
- 9
- vulns_high
- 63
- vulns_low
- 7
- vulns_medium
- 39
- vulns_unknown
- 1
CI workflows (zizmor)ok
- findings
- 198
- findings_high
- 141
- findings_low
- 12
- findings_medium
- 45
- penalty
- 1,780.80
- workflows
- 29
Security postureok1 item
- Security policy: SECURITY.md
SECURITY.md
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 97.0%
- unpinned_manifests
- 0
Release downloadsok6 items
- release v0.45.0 ships ComfyUI_windows_portable_amd.7z (9042 downloads)
- release v0.45.0 ships ComfyUI_windows_portable_intel.7z (3415 downloads)
- release v0.45.0 ships ComfyUI_windows_portable_nvidia.7z (82549 downloads)
- release v0.45.0 ships ComfyUI_windows_portable_nvidia_arm64.7z (991 downloads)
- release v0.45.0 ships ComfyUI_windows_portable_nvidia_cu126.7z (15714 downloads)
- links directly to a downloadable archive or installer
README.md
- binary_assets
- 47
- signals
- 2
- suspicious
- 0
Findings
9 critical410 high107 medium26 low4 info
556 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-332p-7hrc-92wf |
requirements.txt | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-3f63-hfp8-52jq |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq | Dependencies (osv-scanner) |
| critical | osv/GHSA-44vg-5wv2-h2hg |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-132, GHSA-44vg-5wv2-h2hg | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-63hf-3vf5-4wqf |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-fgcw-684q-jj6r |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
requirements.txt | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| high | opengrep/python.lang.maintainability.useless-inner-function |
api_server/routes/internal/internal_routes.py:22 | function `get_logs` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
api_server/routes/internal/internal_routes.py:26 | function `get_raw_logs` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
api_server/routes/internal/internal_routes.py:34 | function `subscribe_logs` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
api_server/routes/internal/internal_routes.py:47 | function `get_folder_paths` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
api_server/routes/internal/internal_routes.py:54 | function `get_files` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/app_settings.py:37 | function `get_settings` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/app_settings.py:41 | function `get_setting` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/app_settings.py:50 | function `post_settings` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/app_settings.py:57 | function `post_setting` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
app/asset_export.py:341 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
app/assets/scanner_admission.py:60 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/custom_node_manager.py:140 | function `get_i18n` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/custom_node_manager.py:96 | function `get_workflow_templates` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/database/db.py:250 | function `set_sqlite_pragma` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/database/db.py:308 | function `set_sqlite_pragma` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/database/db.py:319 | function `configure_write_connection` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/database/db.py:324 | function `begin_immediate` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/model_manager.py:30 | function `get_model_folders` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/model_manager.py:46 | function `get_all_models` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/model_manager.py:54 | function `get_model_preview` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/node_replace_manager.py:121 | function `get_node_replacements` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/subgraph_manager.py:123 | function `get_global_subgraphs` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/subgraph_manager.py:128 | function `get_global_subgraph` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:126 | function `get_users` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:137 | function `post_users` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:150 | function `listuserdata` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:214 | function `list_userdata_v2` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:334 | function `getuserdata` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:364 | function `post_userdata` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:427 | function `delete_userdata` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
app/user_manager.py:437 | function `move_userdata` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
comfy/anonymous_file.py:41 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
comfy/anonymous_file.py:48 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/clip_model.py:281 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/controlnet.py:101 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
comfy/k_diffusion/utils.py:289 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
comfy/k_diffusion/utils.py:291 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/latent_formats.py:238 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
comfy/ldm/ace/ace_step15.py:1130 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
comfy/ldm/ace/ace_step15.py:1133 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
comfy/ldm/ace/ace_step15.py:1136 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/flux/controlnet.py:62 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/flux/controlnet.py:64 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/flux3/model.py:100 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/flux3/model.py:96 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/hidream_o1/model.py:205 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/hidream_o1/model.py:206 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/hidream_o1/model.py:237 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/hidream_o1/model.py:250 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/hydit/models.py:65 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/kandinsky5/model.py:383 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/kandinsky5/model.py:384 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/kandinsky5/model.py:386 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:1107 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:1108 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:1111 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:876 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:877 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/lumina/model.py:880 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/mage_flow/model.py:146 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/mage_flow/model.py:147 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/mage_flow/model.py:149 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/minimax/model.py:736 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/minimax/model.py:868 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/attention.py:1227 | Function forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/attention.py:1236 | Function forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/attention.py:1343 | Function forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/attention.py:1382 | Function forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/modules/diffusionmodules/mmdit.py:465 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/modules/diffusionmodules/mmdit.py:745 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/diffusionmodules/openaimodel.py:853 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/diffusionmodules/openaimodel.py:854 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/diffusionmodules/openaimodel.py:879 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/diffusionmodules/openaimodel.py:893 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/modules/diffusionmodules/openaimodel.py:906 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/pixart/pixartms.py:108 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/pixart/pixartms.py:47 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image/model.py:529 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image/model.py:530 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image/model.py:532 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image21/model.py:466 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image21/model.py:467 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/qwen_image21/model.py:473 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/sam3d_body/model/transformer.py:34 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/sam3d_body/model/transformer.py:56 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/sensenova/model.py:595 | Function _forward mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/triposplat/gaussian.py:25 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
comfy/ldm/triposplat/gaussian.py:28 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1440 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1441 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1443 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1702 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1703 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1705 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1750 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1781 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1782 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:1784 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:583 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:622 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:623 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:625 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:818 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:854 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:855 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:857 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:963 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:964 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model.py:966 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate.py:535 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate.py:536 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate.py:538 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.list-modify-while-iterate |
comfy/ldm/wan/model_animate2.py:151 | It appears that `self.slots` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate2.py:291 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate2.py:344 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate2.py:345 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate2.py:350 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_animate2.py:363 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_vsr.py:131 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_vsr.py:132 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_vsr.py:142 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_vsr.py:150 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_wandancer.py:125 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_wandancer.py:174 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_wandancer.py:175 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/ldm/wan/model_wandancer.py:177 | Function forward_orig mutates default dict transformer_options. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:111 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:114 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:125 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:127 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:129 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:134 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:136 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:139 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:146 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:148 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:151 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:153 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:155 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:167 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:170 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:174 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:182 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:186 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:188 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:192 | Function model_lora_keys_clip mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:204 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:205 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:207 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:214 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:215 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:222 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:229 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:237 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:240 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:243 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:246 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:254 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:262 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:265 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:268 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:274 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:281 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:282 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:283 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:284 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:288 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:290 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:296 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:307 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:308 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:315 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:316 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:323 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:329 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:335 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:347 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:349 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:350 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:358 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:359 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:364 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:369 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:370 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:371 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:379 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:380 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:381 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:382 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:390 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:391 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:392 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:393 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:399 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:400 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:406 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:407 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:413 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:419 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.default-mutable-dict |
comfy/lora.py:425 | Function model_lora_keys_unet mutates default dict key_map. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the... | Lint |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
.ci/update_windows/update.py:150 | Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
.ci/update_windows/update.py:150 | Detected subprocess function 'check_call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | zizmor/unpinned-uses |
.github/workflows/api-node-template.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/api-node-template.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/github-app |
.github/workflows/backport_release.yaml:25 | dangerous use of GitHub App tokens [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-ai-co-authors.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-line-endings.yml:13 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/cla.yml:102 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/cla.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/cla.yml:6 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/openapi-lint.yml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/openapi-lint.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pullrequest-ci-run.yml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pullrequest-ci-run.yml:45 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/pullrequest-ci-run.yml:5 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:28 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:29 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:30 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:31 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:33 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:34 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:35 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:36 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:42 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:44 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:45 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:47 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:51 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:52 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:53 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:57 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:58 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:62 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:64 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:65 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:66 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:67 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:68 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:71 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:72 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:73 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:74 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:75 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:79 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:83 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:85 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:86 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:87 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:88 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release-webhook.yml:89 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ruff.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ruff.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ruff.yml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ruff.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/stable-release.yml:104 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:114 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:117 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:125 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:125 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:125 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:125 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:125 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:129 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:132 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:139 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:160 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:168 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/stable-release.yml:168 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/stable-release.yml:182 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/stable-release.yml:99 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/stale-issues.yml:13 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-build.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-build.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-ci.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-ci.yml:93 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-execution.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-execution.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-launch.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-launch.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-launch.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-unit.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-unit.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api-stubs.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api-stubs.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api-stubs.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-ci-container.yml:23 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-ci-container.yml:25 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-ci-container.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-ci-container.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-version.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-version.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-version.yml:55 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-version.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-version.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/update-version.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_arm64_release_dependencies.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_arm64_release_dependencies.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_arm64_release_dependencies.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies.yml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:60 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:60 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:60 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:64 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:64 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies.yml:64 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies.yml:67 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies_manual.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies_manual.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies_manual.yml:48 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies_manual.yml:52 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies_manual.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies_manual.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_dependencies_manual.yml:56 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_dependencies_manual.yml:59 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_nightly_pytorch.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_nightly_pytorch.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:49 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:52 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:55 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_nightly_pytorch.yml:75 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_nightly_pytorch.yml:88 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_package.yml:100 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_package.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:44 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:47 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows_release_package.yml:51 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:59 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:62 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:65 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:66 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/windows_release_package.yml:90 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
app/database/db.py:287 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | osv/GHSA-22hg-r758-rrw9 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-29pf-2h5f-8g72 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2289, GHSA-29pf-2h5f-8g72 | Dependencies (osv-scanner) |
| high | osv/GHSA-2fqr-mr3j-6wp8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2112, GHSA-2fqr-mr3j-6wp8 | Dependencies (osv-scanner) |
| high | osv/GHSA-2g87-pp6c-29x5 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-2g87-pp6c-29x5 | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-44wm-f244-xhp3 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3 | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-45hq-cxwh-f6vc |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc | Dependencies (osv-scanner) |
| high | osv/GHSA-4fvr-rgm6-gqmc |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2107, GHSA-4fvr-rgm6-gqmc | Dependencies (osv-scanner) |
| high | osv/GHSA-4m7w-qmgq-4wj5 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-237, GHSA-4m7w-qmgq-4wj5 | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5wr8-gcqf-gqf3 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-5wr8-gcqf-gqf3 | Dependencies (osv-scanner) |
| high | osv/GHSA-5x94-69rx-g8h2 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-62p4-gmf7-7g93 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 | Dependencies (osv-scanner) |
| high | osv/GHSA-63hw-fmq6-xxg2 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2110, GHSA-63hw-fmq6-xxg2 | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-69w3-r845-3855 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2288, GHSA-69w3-r845-3855 | Dependencies (osv-scanner) |
| high | osv/GHSA-6mq8-rvhq-8wgg |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1101, GHSA-6mq8-rvhq-8wgg | Dependencies (osv-scanner) |
| high | osv/GHSA-6r8x-57c9-28j4 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-8v84-f9pq-wr9x |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x | Dependencies (osv-scanner) |
| high | osv/GHSA-9hw9-ch79-4vh6 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-9x8q-7h8h-wcw9 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2113, GHSA-9x8q-7h8h-wcw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-9xw5-w5jj-pvcg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-9xw5-w5jj-pvcg | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-cq5v-8q36-5273 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3545, GHSA-cq5v-8q36-5273 | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-g3cq-j2xw-wf74 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2111, GHSA-g3cq-j2xw-wf74 | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
requirements.txt | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-hcc4-c3v8-rx92 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2095, GHSA-hcc4-c3v8-rx92 | Dependencies (osv-scanner) |
| high | osv/GHSA-hg6j-4rv6-33pg |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2105, GHSA-hg6j-4rv6-33pg | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg22-mg44-37j8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2104, GHSA-jg22-mg44-37j8 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
requirements.txt | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-jjj6-mw9f-p565 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 | Dependencies (osv-scanner) |
| high | osv/GHSA-m5qp-6w8w-w647 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2098, GHSA-m5qp-6w8w-w647 | Dependencies (osv-scanner) |
| high | osv/GHSA-m6qw-4cw2-hm4m |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2106, GHSA-m6qw-4cw2-hm4m | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-p998-jp59-783m |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2097, GHSA-p998-jp59-783m | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-phj9-mv4w-65pm |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-vjc4-5qp5-m44j |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j | Dependencies (osv-scanner) |
| high | osv/GHSA-x9r9-c232-4q39 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4174, GHSA-x9r9-c232-4q39 | Dependencies (osv-scanner) |
| high | osv/GHSA-xcgm-r5h9-7989 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2108, GHSA-xcgm-r5h9-7989 | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
requirements.txt | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| high | osv/GHSA-xj96-63gp-2gmr |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr | Dependencies (osv-scanner) |
| high | osv/GHSA-xrqw-3rrv-vx5w |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3929, GHSA-xrqw-3rrv-vx5w | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-211 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-211 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-212 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-212 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-213 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-213 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-214 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-214 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-215 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-215 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-216 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-216 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-217 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-217 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-218 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-218 | Dependencies (osv-scanner) |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-urllib |
script_examples/basic_api_example.py:109 | Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and... | Static analysis (opengrep) |
| high | opengrep/python.django.security.injection.command.subprocess-injection |
tests-unit/assets_test/conftest.py:145 | Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tests-unit/assets_test/conftest.py:145 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | zizmor/artipacked |
.github/workflows/backport_release.yaml:30 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/check-ai-co-authors.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/check-ai-co-authors.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/check-line-endings.yml:12 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/check-line-endings.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/archived-uses |
.github/workflows/cla.yml:59 | action or reusable workflow from archived repository [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/notify-on-merge.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/openapi-lint.yml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/pullrequest-ci-run.yml:3 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/pullrequest-ci-run.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/secrets-inherit |
.github/workflows/release-stable-all.yml:18 | secrets unconditionally inherited by called workflow [confidence high] | CI workflows (zizmor) |
| medium | zizmor/secrets-inherit |
.github/workflows/release-stable-all.yml:35 | secrets unconditionally inherited by called workflow [confidence high] | CI workflows (zizmor) |
| medium | zizmor/secrets-inherit |
.github/workflows/release-stable-all.yml:53 | secrets unconditionally inherited by called workflow [confidence high] | CI workflows (zizmor) |
| medium | zizmor/secrets-inherit |
.github/workflows/release-stable-all.yml:70 | secrets unconditionally inherited by called workflow [confidence high] | CI workflows (zizmor) |
| medium | zizmor/secrets-inherit |
.github/workflows/release-stable-all.yml:87 | secrets unconditionally inherited by called workflow [confidence high] | CI workflows (zizmor) |
| medium | zizmor/template-injection |
.github/workflows/release-webhook.yml:32 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release-webhook.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ruff.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ruff.yml:11 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ruff.yml:25 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ruff.yml:30 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ruff.yml:6 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/tag-dispatch-cloud.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-build.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test-build.yml:23 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-ci.yml:20 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-ci.yml:3 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-ci.yml:74 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-execution.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test-execution.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-launch.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test-launch.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test-unit.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test-unit.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/update-api-stubs.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/update-api-stubs.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/update-ci-container.yml:14 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/update-ci-container.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/update-version.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/windows_arm64_release_dependencies.yml:18 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/windows_arm64_release_dependencies.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/windows_release_dependencies.yml:38 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/windows_release_dependencies.yml:41 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/windows_release_dependencies_manual.yml:30 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/windows_release_dependencies_manual.yml:33 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
app/assets/database/queries/__init__.py:44 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.formatted-sql-query |
app/database/db.py:287 | Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
app/database/db.py:52 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
app/governance.py:57 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
comfy/k_diffusion/utils.py:42 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.dangerous-globals-use |
comfy/ldm/trellis2/vae.py:781 | Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.dangerous-globals-use |
comfy/ldm/trellis2/vae.py:787 | Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
comfy/ldm/util.py:86 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
comfy/ldm/util.py:88 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
comfy_api/generate_api_stubs.py:23 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.logging.python-logger-credential-disclosure |
comfy_api_nodes/util/_helpers.py:112 | Detected a python logger call with a potential hardcoded secret "Comfy API refused to renew the sign-in token (HTTP %s)." being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging ... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.logging.python-logger-credential-disclosure |
comfy_api_nodes/util/_helpers.py:124 | Detected a python logger call with a potential hardcoded secret "Could not renew the sign-in token: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.logging.python-logger-credential-disclosure |
comfy_api_nodes/util/_helpers.py:129 | Detected a python logger call with a potential hardcoded secret "Could not renew the sign-in token: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
comfy_api_nodes/util/request_logger.py:39 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | osv/GHSA-24rc-8hj2-v98c |
requirements.txt | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
requirements.txt | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-2vrm-gr82-f7m5 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2096, GHSA-2vrm-gr82-f7m5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-37mw-44qp-f5jm |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1977, GHSA-37mw-44qp-f5jm | Dependencies (osv-scanner) |
| medium | osv/GHSA-3wq7-rqq7-wx6j |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2099, GHSA-3wq7-rqq7-wx6j | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
requirements.txt | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-489j-g2vx-39wf |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1979, GHSA-489j-g2vx-39wf | Dependencies (osv-scanner) |
| medium | osv/GHSA-494j-54xm-rwp3 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-494j-54xm-rwp3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w7r-h757-3r74 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1980, GHSA-4w7r-h757-3r74 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4x4j-2g7c-83w6 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-59p9-h35m-wg4g |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1981, GHSA-59p9-h35m-wg4g | Dependencies (osv-scanner) |
| medium | osv/GHSA-6cjc-53gc-5rqm |
requirements.txt | [email protected] (PyPI) is affected by GHSA-6cjc-53gc-5rqm | Dependencies (osv-scanner) |
| medium | osv/GHSA-6jhg-hg63-jvvf |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1100, GHSA-6jhg-hg63-jvvf | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9356-575x-2w9m |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1983, GHSA-9356-575x-2w9m | Dependencies (osv-scanner) |
| medium | osv/GHSA-966j-vmvw-g2g9 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2100, GHSA-966j-vmvw-g2g9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c427-h43c-vf67 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2103, GHSA-c427-h43c-vf67 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f9xw-jh8m-3mwq |
requirements.txt | [email protected] (PyPI) is affected by GHSA-f9xw-jh8m-3mwq | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fj7v-r99m-22gq |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq | Dependencies (osv-scanner) |
| medium | osv/GHSA-g84x-mcqj-x9qq |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1106, GHSA-g84x-mcqj-x9qq | Dependencies (osv-scanner) |
| medium | osv/GHSA-hpj7-wq8m-9hgp |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2109, GHSA-hpj7-wq8m-9hgp | Dependencies (osv-scanner) |
| medium | osv/GHSA-jj3x-wxrx-4x23 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1107, GHSA-jj3x-wxrx-4x23 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jjph-296x-mrcr |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1985, GHSA-jjph-296x-mrcr | Dependencies (osv-scanner) |
| medium | osv/GHSA-mfx4-hv73-q22v |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3546, GHSA-mfx4-hv73-q22v | Dependencies (osv-scanner) |
| medium | osv/GHSA-mq44-7p77-q5h7 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3547, GHSA-mq44-7p77-q5h7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mr82-8j83-vxmv |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1812, GHSA-mr82-8j83-vxmv | Dependencies (osv-scanner) |
| medium | osv/GHSA-mwh4-6h8g-pg8w |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2101, GHSA-mwh4-6h8g-pg8w | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-pqxq-w44r-73xw |
requirements.txt | [email protected] (PyPI) is affected by GHSA-pqxq-w44r-73xw | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2wp-rjmx-x6x9 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1987, GHSA-q2wp-rjmx-x6x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r73j-pqj5-w3x7 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rcv9-qm8p-9p6j |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1988, GHSA-rcv9-qm8p-9p6j | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-w2fm-2cpv-w7v5 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2094, GHSA-w2fm-2cpv-w7v5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjx4-4jcj-g98j |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
requirements.txt | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| medium | opengrep/python.lang.security.audit.insecure-transport.urllib.insecure-request-object |
script_examples/basic_api_example.py:109 | Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/basic_api_example.py:110 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example.py:17 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example.py:22 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example.py:26 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example_ws_images.py:17 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example_ws_images.py:22 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
script_examples/websockets_api_example_ws_images.py:26 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | osv/GHSA-6w46-j5rx-g56g |
tests-unit/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g | Dependencies (osv-scanner) |
| low | zizmor/adhoc-packages |
.github/workflows/openapi-lint.yml:28 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release-stable-all.yml:18 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release-stable-all.yml:35 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release-stable-all.yml:53 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release-stable-all.yml:70 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release-stable-all.yml:87 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/stable-release.yml:128 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/adhoc-packages |
.github/workflows/update-api-stubs.yml:25 | ad-hoc installation of packages [confidence high] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
comfy/text_encoders/ernie.py:6 | Possible generic-api-key secret in history (commit 31283d2892); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
comfy/text_encoders/flux.py:87 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
comfy_api/_impl/legacy_imports.py:41 | Possible generic-api-key secret in history (commit c87d526993); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-54jq-c3m8-4m76 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1097, GHSA-54jq-c3m8-4m76 | Dependencies (osv-scanner) |
| low | osv/GHSA-69f9-5gxw-wvc2 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1099, GHSA-69f9-5gxw-wvc2 | Dependencies (osv-scanner) |
| low | osv/GHSA-9548-qrrj-x5pj |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1104, GHSA-9548-qrrj-x5pj | Dependencies (osv-scanner) |
| low | osv/GHSA-fh55-r93g-j68g |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1105, GHSA-fh55-r93g-j68g | Dependencies (osv-scanner) |
| low | osv/GHSA-gx76-c99x-2c96 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-gx76-c99x-2c96 | Dependencies (osv-scanner) |
| low | osv/GHSA-mqqc-3gqh-h2x8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1109, GHSA-mqqc-3gqh-h2x8 | Dependencies (osv-scanner) |
| low | osv/GHSA-phhr-52qp-3mj4 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1986, GHSA-phhr-52qp-3mj4 | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
tests-unit/app_test/agent_host_test.py:379 | Possible generic-api-key secret in history (commit d9475dd647); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests-unit/comfy_api_test/v3/import_compatibility_test.py:35 | Possible generic-api-key secret in history (commit a72581e179); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests-unit/execution_test/test_cache_provider.py:336 | Possible generic-api-key secret in history (commit da514866d6); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/assets/TerminalOutputDrawer-BgTEspHP.js:694 | Possible generic-api-key secret in history (commit b3d6ae15b3); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/assets/index-B6dYHNhg.js:63541 | Possible generic-api-key secret in history (commit 4ac401af2b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/assets/index-CJmKJOqY.js:115967 | Possible generic-api-key secret in history (commit a39ea87bca); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/assets/index-CSl7lfOs.js:54778 | Possible generic-api-key secret in history (commit 5262901c5c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
web/assets/index-CoOvI8ZH.js:73412 | Possible generic-api-key secret in history (commit 53646e0f32); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/superfluous-actions |
.github/workflows/stable-release.yml:182 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/update-ci-container.yml:43 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/windows_release_nightly_pytorch.yml:88 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/windows_release_package.yml:100 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 198 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 119 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 28 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 11 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | eee59185ff4f | prov-5+qual-2+sec-2 | 0% | 59 | 55 |
Full text report
- Repository: https://github.com/Comfy-Org/ComfyUI
- Commit:
eee59185ff4f43ae2d9ad122b245619d27d9daad - Generated: 2026-11-14T15:21:29+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 59 | weak | 90% | 100% |
| Security | 55 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.3%
- Unattributed share in AI-consistent velocity bursts: 65.8%
- Estimated AI-generated share: 0.3%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 25 | 3,643 |
| Cursor agent | 6 | 67 |
| GitHub Copilot coding agent | 1 | 0 |
| OpenAI Codex | 1 | 1,899 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 2,373 of 292,737.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.421 | 0.685 | 0.61x |
| Security | 0.0 | 0.103 | 0.0x |
- Stylometry index: 0.15 per 1,000 lines (narrated steps 39, placeholders 0, assistant phrasing 0, emoji 13). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 10,530 | 0% |
| 2026-01 | 23,154 | 0% |
| 2026-02 | 13,985 | 0% |
| 2026-03 | 22,424 | 12% |
| 2026-04 | 11,000 | 0% |
| 2026-05 | 26,914 | 0% |
| 2026-06 | 23,692 | 0% |
| 2026-07 | 18,793 | 0% |
| 2026-08 | 45,169 | 0% |
| 2026-09 | 52,383 | 4% |
| 2026-10 | 29,611 | 0% |
| 2026-11 | 9,459 | 4% |
Evidence
- Claude Code: PR description attribution (dd196a9ce74d)
- Claude Code: PR description attribution (1a82e6d01f39)
- Claude Code: PR description attribution (fa98a189b427)
- Claude Code: PR description attribution (99073836d45f)
- Claude Code: PR description attribution (a20738f1d345)
- Claude Code: PR description attribution (7193f5627f03)
- Claude Code: PR description attribution (6c53f8c9a06d)
- OpenAI Codex: PR branch 'codex/support-sensenova-u15' (3216c62e9962)
- Claude Code: author claude[bot] (a683fa6e577f)
- Claude Code: PR description attribution (16e3f3034f2b)
- Claude Code: PR description attribution (c6cb9049943a)
- Claude Code: PR description attribution (c7b246edc440)
- Claude Code: PR description attribution (431a1888d311)
- Claude Code: PR description attribution (6dd3c67427d6)
- Cursor agent: PR branch 'cursor/emit-hash-on-asset-responses-a601' (6de7fc063b66)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.19, CI runs tests; 19% of function code in complex or long functions; 12% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 56 |
| Duplication | 49 |
| Code smells (Opengrep) | 22 |
| Tests and CI | 84 |
| Documentation | 80 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 12,753; mean complexity 3.3, 90th percentile 7; 322 complex and 164 long functions
- Duplicated lines: 11.9% of 231,006 compared
- Tests: 54,893 test lines for 292,737 source lines (ratio 0.19); CI test commands: pytest; 30% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- detect_unet_config in comfy/model_detection.py: complexity 242, 1163 lines
- init in comfy/sd.py: complexity 133, 611 lines
- _save_transcoded in comfy_api/latest/_input_impl/video_types.py: complexity 119, 291 lines
- load_text_encoder_state_dicts in comfy/sd.py: complexity 112, 354 lines
- model_lora_keys_unet in comfy/lora.py: complexity 104, 202 lines
Security
Security posture is weak: 119 known vulnerabilities in 6 dependencies; 6 high-severity SAST findings; 141 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 69 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | 33 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 119 in 6 packages (critical 9, high 63, medium 39, low 7)
-
Posture checks passed: security policy, signed commits, lockfiles; missing: dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
requirements.txt |
| critical | osv/GHSA-3f63-hfp8-52jq: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq |
requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
requirements.txt |
| critical | osv/GHSA-63hf-3vf5-4wqf: [email protected] (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf |
requirements.txt |
| critical | osv/GHSA-44vg-5wv2-h2hg: [email protected] (PyPI) is affected by PYSEC-2026-132, GHSA-44vg-5wv2-h2hg |
requirements.txt |
| critical | osv/GHSA-fgcw-684q-jj6r: [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r |
requirements.txt |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.ci/update_windows/update.py:150 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'check_call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
.ci/update_windows/update.py:150 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
app/database/db.py:287 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-urllib: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the res [confidence medium] |
script_examples/basic_api_example.py:109 |
| high | opengrep/python.django.security.injection.command.subprocess-injection: Detected user input entering a subprocess call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the serve [confidence high] |
tests-unit/assets_test/conftest.py:145 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tests-unit/assets_test/conftest.py:145 |
| high | osv/GHSA-44wm-f244-xhp3: [email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3 |
requirements.txt |
| high | osv/GHSA-8v84-f9pq-wr9x: [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x |
requirements.txt |
| high | osv/GHSA-5x94-69rx-g8h2: [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 |
requirements.txt |
| high | osv/GHSA-45hq-cxwh-f6vc: [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc |
requirements.txt |
| high | osv/GHSA-phj9-mv4w-65pm: [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm |
requirements.txt |
| high | osv/GHSA-6r8x-57c9-28j4: [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 |
requirements.txt |
| high | osv/GHSA-9hw9-ch79-4vh6: [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 |
requirements.txt |
| high | osv/GHSA-xj96-63gp-2gmr: [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr |
requirements.txt |
| high | osv/GHSA-62p4-gmf7-7g93: [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 |
requirements.txt |
| high | osv/GHSA-jjj6-mw9f-p565: [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 |
requirements.txt |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.45.0 ships ComfyUI_windows_portable_amd.7z (9042 downloads)
- binary-release-asset: release v0.45.0 ships ComfyUI_windows_portable_intel.7z (3415 downloads)
- binary-release-asset: release v0.45.0 ships ComfyUI_windows_portable_nvidia.7z (82549 downloads)
- binary-release-asset: release v0.45.0 ships ComfyUI_windows_portable_nvidia_arm64.7z (991 downloads)
- binary-release-asset: release v0.45.0 ships ComfyUI_windows_portable_nvidia_cu126.7z (15714 downloads)
- readme-download-lure: links directly to a downloadable archive or installer
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 292,737; test lines: 54,893
| Language | Lines |
|---|---|
| Python | 347,527 |
| Shell | 103 |