pyVideoTrans takes a video in one language and gives it back in another. It runs speech recognition to make subtitles, translates them, generates a dubbed voice track and re-times audio and video so they line up, in one workflow that can pause at each stage for you to proofread. It also does the steps on their own: audio to SRT subtitles with speaker separation, subtitle translation, or text to speech.
Its strength is choice. Recognition can be Faster-Whisper on your own machine or a cloud service; translation can go through local Ollama or M2M100, or DeepSeek, ChatGPT, Claude and Gemini; voices can come from free Edge-TTS, commercial APIs, or self-hosted open models such as F5-TTS, CosyVoice and GPT-SoVITS. There is a desktop app, a command line for batch work and a browser WebUI. It is GPL-3.0 with about 19,500 stars, at v4.17 when scanned.
A fully local pipeline wants an NVIDIA GPU to be quick (the Windows build expects CUDA 12.8 and cuDNN 9.11). Cloud channels are easier to set up but send your audio and text to those providers and bill your keys, and the result depends heavily on which channels you pick.
- Repository: github.com/jianchang512/pyvideotrans
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: Python. Stars: 19.5K. Forks: 2,419. Last push: Oct 23, 2026.
- Scan: safe, Oct 26, 2026, commit a52eeee
Who it is for
Creators who want to publish videos in more than one language, people who need subtitles for lectures and interviews, and anyone translating video they have the rights to.
Getting started
1. Windows users can download the prepackaged release and run sp.exe. From source (needs FFmpeg and uv):
git clone https://github.com/jianchang512/pyvideotrans.git && cd pyvideotrans && uv sync2. Launch the desktop app
uv run sp.py3. Or translate a video from the command line
uv run cli.py --task vtv --name "./video.mp4" --source_language_code zh-cn --target_language_code en --voice_role "en-US-GuyNeural"Unzip the Windows build to a path without spaces or Chinese characters. For the browser interface, run uv sync --extra webui and then uv run webui.py. The README's sponsor table and channel list include referral links to API resellers; any provider you already have a key for works just as well.
Safety scan
We cloned jianchang512/pyvideotrans at commit a52eeee on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries, no install hooks and no bare-IP URLs across about 70,000 lines of Python.
- The many outside hosts are the services it can call, such as OpenRouter, Zhipu (open.bigmodel.cn), Fish Audio, 302.AI and Aliyun, plus Hugging Face and ModelScope for model downloads. Each is used only when you pick that channel and enter a key.
- 282 known advisories in uv.lock (12 critical, 131 high), and this is the app's runtime environment, not just build tooling: Pillow, aiohttp, h11, Brotli, certifi, Keras 2.9 and GitPython among them. Most concern hostile input to servers and parsers, so the realistic exposure is the optional WebUI if you open it to a network. The prepackaged Windows build bundles the same libraries.
- 2 workflows, no pull_request_target; the one third-party action is not pinned to a commit. Licence present; no security policy, contributing guide or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often pyvideotrans.com, github.com, huggingface.co, modelscope.cn. No URLs to bare IP addresses. |
| Known vulnerabilities | 282 advisories across 420 pinned packages: 12 critical, 131 high, 101 moderate, 37 low, 1 unrated. uv.lock: 423 packages, 282 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 282)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 | critical | anyio@4.9.0 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-9v8h-qqgm-4m35 | critical | brotli@1.2.0 | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package |
| GHSA-9v8h-qqgm-4m35 | critical | brotlicffi@1.2.0.1 | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2025.10.5 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.50 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-vqfr-h8mv-ghfj | critical | h11@0.14.0 | h11 accepts some malformed Chunked-Encoding bodies |
| GHSA-x4wf-678h-2pmq | critical | keras@2.9.0 | Keras code injection vulnerability |
| GHSA-332p-7hrc-92wf | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-5x8w-8jj5-q52h | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| GHSA-8g5g-8vmr-9782 | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-v9pv-5gc8-w2m6 | critical | pillow@12.1.1 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-w889-685w-c8fh | critical | pillow@12.1.1 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.12.13 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.12.13 | aiohttp server lacks an initial request/header timeout |
| GHSA-6mq8-rvhq-8wgg | high | aiohttp@3.12.13 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.12.13 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.12.13 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-537c-gmf6-5ccf | high | cryptography@45.0.4 | Vulnerable OpenSSL included in cryptography wheels |
| GHSA-g6cj-pr64-35w5 | high | cryptography@45.0.4 | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
| GHSA-jwv3-5hgf-82ww | high | cryptography@45.0.4 | python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| GHSA-r6ph-v2qm-q3c2 | high | cryptography@45.0.4 | cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
| GHSA-7wx4-6vff-v64p | high | diffusers@0.33.1 | Diffusers: TOCTOU Trust Remote Code Bypass |
| GHSA-98h9-4798-4q5v | high | diffusers@0.33.1 | Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components |
| GHSA-j7w6-vpvq-j3gm | high | diffusers@0.33.1 |
By the numbers
| Stars | 19.5K |
|---|---|
| Forks | 2,419 |
| Contributors | 50 |
| Commits | 1,641 |
| Open issues | 5 |
| Open pull requests | 1 |
| Releases | 96 |
| Latest release | v4.17 |
| Licence | GPL-3.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 23, 2026 |
| Tracked files | 701 |
| Lines of code | 91.6K |
| Checkout size | 17 MB |
Lines by language: Python 70.5K, JSON 13.6K, Markdown 5,859, YAML 778, TOML 338, CUDA 246.
Questions
Is pyVideoTrans free?
Yes. pyVideoTrans is free and open source under GPL-3.0, including the prepackaged Windows build. Local models cost nothing beyond your hardware; cloud channels bill your own API keys.
Can pyVideoTrans run fully offline?
Yes, if you choose local channels throughout: Faster-Whisper for recognition, Ollama or M2M100 for translation and a locally deployed TTS model for the voice. Edge-TTS is free but is an online Microsoft service.
Can pyVideoTrans clone a speaker's voice?
It can, through integrations such as F5-TTS, CosyVoice and GPT-SoVITS. Only clone a voice with that person's permission; the README's disclaimer makes users responsible for how they use it and for the rights to the videos they process.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.