Metrics:
Total lines of code: 3657
Total lines skipped (#nosec): 0

blacklist: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/__init__.py
Line number: 6
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess
2	import os
3	import importlib
4	import pkg_resources
5	import sys
6	import subprocess
7	import folder_paths
8	
9	supported_LLava_extensions = set(['.gguf'])
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/__init__.py
Line number: 35
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
31	
32	    if missing_packages:
33	        print(f"Missing or outdated packages: {', '.join(missing_packages)}")
34	        print("Installing/Updating missing packages...")
35	        subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', *missing_packages])
36	    else:
37	        print("All packages from requirements.txt are installed and up to date.")
38	
blacklist: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/install_init.py
Line number: 7
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess
3	import shutil
4	from os.path import join, dirname, abspath, exists
5	from os import makedirs, symlink, readlink
6	import platform
7	import subprocess
8	import sys
9	import importlib.util
10	import re
request_without_timeout: Requests call without timeout
Test ID: B113
Severity: MEDIUM
Confidence: LOW
CWE: CWE-400
File: /custom_nodes/ComfyUI_VLM_nodes/install_init.py
Line number: 80
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html
76	    return system_info
77	
78	def latest_lamacpp():
79	    try:        
80	        response = get("https://api.github.com/repos/abetlen/llama-cpp-python/releases/latest")
81	        return response.json()["tag_name"].replace("v", "")
82	    except Exception:
83	        return "0.2.20"
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/install_init.py
Line number: 91
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
87	        print(f"Installing {package_name}...")
88	        command = [sys.executable, "-m", "pip", "install", package_name, "--no-cache-dir"]
89	        if custom_command:
90	            command += custom_command.split()
91	        subprocess.check_call(command)
92	    else:
93	        print(f"{package_name} is already installed.")
94	
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/install_init.py
Line number: 144
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
140	        
141	        # Execute the installation command
142	        try:
143	            print(f"Installing AutoGPTQ with command: {' '.join(base_command)}")
144	            subprocess.check_call(base_command)
145	        except Exception as e:
146	            print(f"Failed to install AutoGPTQ: {e}")
147	
try_except_pass: Try, Except, Pass detected.
Test ID: B110
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/install_init.py
Line number: 233
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html
229	        try:
230	            import _winapi
231	            _winapi.CreateJunction(src, dst)
232	            return True
233	        except:
234	            pass
235	    try:
236	        os.symlink(src, dst)
237	        return True
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 177
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
173			self.out_dim = out_dim
174			self.norm_qk = norm_qk
175			self.num_heads = num_attention_heads
176			self.head_dim = hidden_size // num_attention_heads
177			assert self.head_dim * num_attention_heads == self.embed_dim, "embed_dim must be divisible by num_attention_heads"
178	
179			self.q_proj = nn.Linear(self.embed_dim, self.embed_dim)
180			self.kv_proj = nn.Linear(self.embed_dim, self.embed_dim * 2)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 312
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
308	def sinusoidal_position_embedding(width: int, height: int, depth: int, dtype, device, temperature = 10000):
309		"""
310		Sinusoidal position embedding. Returns a flat tensor of shape (h * w, d).
311		"""
312		assert depth % 4 == 0, "Embedding dimension must be divisible by 4."
313	
314		y, x = torch.meshgrid(torch.arange(height, device=device), torch.arange(width, device=device), indexing="ij")
315		omega = torch.arange(depth // 4, device=device) / (depth // 4 - 1)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 329
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
325	class CLIPEmbeddingLayer(nn.Module):
326		def __init__(self, hidden_size: int, num_channels: int, image_size: int, patch_size: int, patch_dropout: float = 0.0, good_dropout: bool = False, dpn: bool = False, sine_positional_embeddings: bool = False):
327			super().__init__()
328	
329			assert image_size % patch_size == 0, "Image dimensions must be divisible by the patch size."
330	
331			seq_len = (image_size // patch_size) ** 2
332			self.patch_dropout = patch_dropout
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 368
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
364				)
365		
366		def forward(self, pixel_values: torch.FloatTensor) -> torch.Tensor:
367			B, C, H, W = pixel_values.shape
368			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
369			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
370	
371			if self.dpn:
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 369
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
365		
366		def forward(self, pixel_values: torch.FloatTensor) -> torch.Tensor:
367			B, C, H, W = pixel_values.shape
368			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
369			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
370	
371			if self.dpn:
372				patches = self.to_patch_embeddings(pixel_values)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 662
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
658		def forward(self, batch):
659			pixel_values = batch['image']
660			device = pixel_values.device
661			B, C, H, W = pixel_values.shape
662			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
663			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
664	
665			# Convert image to patches (B, seq_len, C * patch_size * patch_size)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 663
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
659			pixel_values = batch['image']
660			device = pixel_values.device
661			B, C, H, W = pixel_values.shape
662			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
663			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
664	
665			# Convert image to patches (B, seq_len, C * patch_size * patch_size)
666			patches = self.to_patches(pixel_values)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 841
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
837			super().__init__()
838			self.num_heads = num_heads
839			self.d_model = d_model
840	
841			assert d_model % num_heads == 0, "d_model must be divisible by num_heads"
842	
843			# MHA
844			self.norm1 = nn.LayerNorm(d_model)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 970
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
966		):
967			super().__init__(image_size, n_tags)
968	
969			#assert image_size % patch_size == 0, "image_size must be divisible by patch_size"
970			assert d_model % num_heads == 0, "d_model must be divisible by num_heads"
971	
972			out_dim = n_tags
973			self.n_tags = n_tags
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 999
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
995			self.head = nn.Linear(d_model, out_dim)
996	
997		def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
998			B, C, H, W = batch['image'].shape
999			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
1000			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
1001	
1002			x = self.patch_embeddings(batch['image'])  # (bsz, d_model, patch_num, patch_num)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/joytagger/Models.py
Line number: 1000
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
996	
997		def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
998			B, C, H, W = batch['image'].shape
999			assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
1000			assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
1001	
1002			x = self.patch_embeddings(batch['image'])  # (bsz, d_model, patch_num, patch_num)
1003			x = x.flatten(2).transpose(1, 2)  # (bsz, patch_num ** 2, d_model)
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/moondream/text_model.py
Line number: 48
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
44	
45	        if "<image>" not in prompt:
46	            embeds.append(self.text_emb(_tokenize(prompt)))
47	        else:
48	            assert prompt.count("<image>") == 1
49	            before, after = prompt.split("<image>")
50	            embeds.append(self.text_emb(_tokenize(f"{before}<image>")))
51	            embeds.append(image_embeds.to(self.model.device))
blacklist: Use of possibly insecure function - consider using safer ast.literal_eval.
Test ID: B307
Severity: MEDIUM
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI_VLM_nodes/nodes/suggest.py
Line number: 599
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval
595	        if attribute_type == "Category":
596	            categories = categories.split(",")
597	            setter.add_attribute(attribute_name, Literal, attribute_description, categories)
598	        else:
599	            attribute_type = eval(attribute_type)
600	            setter.add_attribute(attribute_name, attribute_type, attribute_description)
601	
602	        Analysis = setter.create_model("Analysis")