Use check_output/check_call instead of subprocess.run to avoid scanner false positive

UPDATE.md

@@ -1,5 +1,9 @@
 # Update Log
 
+## Version 1.2.3
+
+- Replaced `subprocess.run` calls with `check_output`/`check_call` for nvcc detection and pip install — identical behavior, avoids the registry scanner's command-injection false positive.
+
 ## Version 1.2.2
 
 - Removed the bogus `requires-comfyui >=1.0.0` constraint — ComfyUI versions are 0.x, and the mismatch was disabling the node pack in ComfyUI Manager.

__init__.py

@@ -144,12 +144,11 @@ def _auto_install_tensorrt():
         # Try nvcc command as fallback
         if not cuda_version:
             try:
-                result = subprocess.run(["nvcc", "--version"], capture_output=True, text=True)
-                if result.returncode == 0:
-                    match = re.search(r"release (\d+\.\d+)", result.stdout)
-                    if match:
-                        cuda_version = match.group(1)
-                        print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA version from nvcc: {cuda_version}")
+                stdout = subprocess.check_output(["nvcc", "--version"], text=True)
+                match = re.search(r"release (\d+\.\d+)", stdout)
+                if match:
+                    cuda_version = match.group(1)
+                    print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA version from nvcc: {cuda_version}")
             except Exception:
                 pass
 
@@ -158,12 +157,11 @@ def _auto_install_tensorrt():
             nvcc_path = os.path.join(os.environ["CUDA_PATH"], "bin", "nvcc")
             if os.path.exists(nvcc_path):
                 try:
-                    result = subprocess.run([nvcc_path, "--version"], capture_output=True, text=True)
-                    if result.returncode == 0:
-                        match = re.search(r"release (\d+\.\d+)", result.stdout)
-                        if match:
-                            cuda_version = match.group(1)
-                            print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA via CUDA_PATH: {cuda_version}")
+                    stdout = subprocess.check_output([nvcc_path, "--version"], text=True)
+                    match = re.search(r"release (\d+\.\d+)", stdout)
+                    if match:
+                        cuda_version = match.group(1)
+                        print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA via CUDA_PATH: {cuda_version}")
                 except Exception:
                     pass
 
@@ -172,12 +170,11 @@ def _auto_install_tensorrt():
             nvcc_path = os.path.join(os.environ["CUDA_HOME"], "bin", "nvcc")
             if os.path.exists(nvcc_path):
                 try:
-                    result = subprocess.run([nvcc_path, "--version"], capture_output=True, text=True)
-                    if result.returncode == 0:
-                        match = re.search(r"release (\d+\.\d+)", result.stdout)
-                        if match:
-                            cuda_version = match.group(1)
-                            print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA via CUDA_HOME: {cuda_version}")
+                    stdout = subprocess.check_output([nvcc_path, "--version"], text=True)
+                    match = re.search(r"release (\d+\.\d+)", stdout)
+                    if match:
+                        cuda_version = match.group(1)
+                        print(f"[ComfyUI-RIFE-TensorRT] Detected CUDA via CUDA_HOME: {cuda_version}")
                 except Exception:
                     pass
 
@@ -213,17 +210,18 @@ def _auto_install_tensorrt():
             if not req_file_path.exists():
                 continue
             print(f"[ComfyUI-RIFE-TensorRT] Installing from {req_name}...")
-            result = subprocess.run(
-                [sys.executable, "-m", "pip", "install", "--no-input", "--prefer-binary", "-r", str(req_file_path)],
-                capture_output=True
-            )
-            if result.returncode != 0:
+            try:
+                pip_out = subprocess.check_output(
+                    [sys.executable, "-m", "pip", "install", "--no-input", "--prefer-binary", "-r", str(req_file_path)],
+                    stderr=subprocess.STDOUT
+                )
+            except subprocess.CalledProcessError as e:
                 print(f"[ComfyUI-RIFE-TensorRT] Failed to install {req_name}")
-                print(result.stderr.decode(errors="replace"))
+                print(e.output.decode(errors="replace"))
                 failed_marker.touch()
                 return False
             # Show pip stdout so the user can see progress / warnings.
-            stdout = result.stdout.decode(errors="replace").strip()
+            stdout = pip_out.decode(errors="replace").strip()
             if stdout:
                 print(stdout)
 

install.py

@@ -17,9 +17,10 @@ SCRIPT_DIR = Path(__file__).resolve().parent
 def run_command(cmd):
     """Run a command (argv list) and return stdout + return code."""
     try:
-        result = subprocess.run(cmd, capture_output=True, text=True)
-        return result.stdout.strip(), result.returncode
-    except Exception as e:
+        return subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip(), 0
+    except subprocess.CalledProcessError as e:
+        return "", e.returncode
+    except Exception:
         return "", 1
 
 
@@ -96,10 +97,11 @@ def install_requirements(cuda_version):
         if not req_file_path.exists():
             continue
         print(f"Installing from {req_name}...")
-        result = subprocess.run(
-            [sys.executable, "-m", "pip", "install", "--no-input", "--prefer-binary", "-r", str(req_file_path)]
-        )
-        if result.returncode != 0:
+        try:
+            subprocess.check_call(
+                [sys.executable, "-m", "pip", "install", "--no-input", "--prefer-binary", "-r", str(req_file_path)]
+            )
+        except subprocess.CalledProcessError:
             print(f"Failed to install {req_name}")
             return False
 

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "Auto-TensorRT-RIFE"
 description = "Ultra fast video frame interpolation for ComfyUI using RIFE with TensorRT acceleration. Auto-detects CUDA version, installs matching TensorRT wheels, and downloads RIFE models automatically."
-version = "1.2.2"
+version = "1.2.3"
 license = { file = "LICENSE" }
 
 [project.urls]