WhisperX takes OpenAI's Whisper and fixes the two things people complain about most: speed and timing. It runs Whisper through the faster-whisper backend in batches, which reaches around 70 times real time with the large-v2 model on a GPU, and it cuts the audio with voice activity detection first, which reduces the hallucinated text Whisper can produce over silence.
Its main trick is forced alignment. After transcribing, WhisperX aligns the text against the audio with a phoneme model (wav2vec2), so every word gets an accurate start and end time instead of Whisper's rough sentence-level timing. Add --diarize and a free Hugging Face token, and pyannote labels each line with its speaker. The output comes as SRT and VTT subtitles, JSON and plain text, which makes it a favourite for subtitles, podcast transcripts, interview notes and research.
It is BSD-2-Clause licensed, with about 24,800 stars, at v3.8.6 when scanned, and installs from PyPI as whisperx. The paper behind it was accepted at INTERSPEECH 2023.
- Repository: github.com/m-bain/whisperX
- Licence: BSD-2-Clause (BSD 2-Clause "Simplified" License)
- Language: Python. Stars: 24.8K. Forks: 2,498. Last push: Oct 18, 2026.
- Scan: safe, Oct 22, 2026, commit db8fde4
Who it is for
Video editors and creators who need accurate subtitles, podcasters and researchers transcribing interviews with several speakers, and developers who want word-level timestamps from Python.
Getting started
1. Install (add the CUDA toolkit first for GPU speed)
pip install whisperx2. Transcribe a file with word timings
whisperx interview.wav --model large-v2 --highlight_words True3. Add speaker labels (needs a Hugging Face read token and the pyannote model terms accepted)
whisperx interview.wav --model large-v2 --diarize --hf_token YOUR_HF_TOKEN4. On a Mac or without a GPU
whisperx interview.wav --compute_type int8 --device cpuAlignment models exist for English, French, German, Spanish, Italian and many other languages, picked automatically with --language. ffmpeg must be installed. Long files on CPU are slow; a GPU with 8 GB of memory handles large-v2.
Safety scan
We cloned m-bain/whisperX at commit db8fde4 on Oct 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- A small codebase: 34 files and about 4,300 lines, nearly all Python. No secrets, no suspicious code patterns and no install hooks; the only hosts in the code are Hugging Face, PyTorch, GitHub and arXiv.
- One committed binary, whisperx/assets/pytorch_model.bin (17.7 MB), the pyannote voice activity model. PyTorch .bin files are pickle-based and can carry code, so this is worth knowing, but it is the project's own long-standing asset rather than something fetched at run time.
- 172 known advisories (7 critical) in uv.lock, the pinned environment for development. The criticals are in certifi, NLTK (unsafe pickle loading and Stanford wrapper flags WhisperX does not use) and Pillow image decoding. pip install whisperx resolves current versions within its ranges, which avoids most of them.
- 4 workflows, none using pull_request_target, with all 4 third-party actions pinned to commits. Licence present; no security policy, Dependabot or CodeQL.
- Diarization downloads pyannote models from Hugging Face with your token; audio stays on your machine.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 4 workflows. None use pull_request_target. 0 of 4 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 4 distinct hosts referenced from source; most often arxiv.org, huggingface.co, github.com, pytorch.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 172 advisories across 137 pinned packages: 7 critical, 81 high, 58 moderate, 25 low, 1 unrated. uv.lock: 137 packages, 172 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Committed binaries (1)
whisperx/assets/pytorch_model.bin: .bin, 18 MB
Worst known vulnerabilities (24 of 172)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2025.10.5 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-m4rf-3fr8-xwx3 | critical | nltk@3.9.4 | NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841… |
| GHSA-rhp5-r9x4-f5g2 | critical | nltk@3.9.4 | NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution |
| GHSA-x99w-6fgc-pmfw | critical | nltk@3.9.4 | NLTK: Allowlisted pickle loaders still permit code execution in current source |
| GHSA-332p-7hrc-92wf | critical | pillow@11.3.0 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-8g5g-8vmr-9782 | critical | pillow@11.3.0 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-w889-685w-c8fh | critical | pillow@11.3.0 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.12.15 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.12.15 | aiohttp server lacks an initial request/header timeout |
| GHSA-6mq8-rvhq-8wgg | high | aiohttp@3.12.15 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.12.15 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.12.15 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-27vj-qcqg-25rc | high | fsspec@2025.9.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
| GHSA-qqmf-gpg7-g8gw | high | lightning@2.5.5 | PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters |
| GHSA-75m9-98v2-hjpm | high | lightning@2.5.5 | PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization |
| GHSA-2h4p-vjrc-8xpq | high | mako@1.3.10 | Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup |
| GHSA-v92g-xgxw-vvmm | high | mako@1.3.10 | Mako: Path traversal via double-slash URI prefix in TemplateLookup |
| GHSA-3gq4-3j92-5w49 | high | nltk@3.9.4 | NLTK: Corpus Reader Sandbox Bypass |
| GHSA-568f-pv23-39p4 | high | nltk@3.9.4 | NLTK: Stable FrameNet and NKJP readers parse outside-root XML |
| GHSA-6hm5-jgcp-p838 | high | nltk@3.9.4 | Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.p… |
| GHSA-6hwm-xvph-95vm | high | nltk@3.9.4 | NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary |
| GHSA-6ww7-3frv-cqxh | high | nltk@3.9.4 | NLTK: pathsec SSRF protection can be bypassed when a proxy is configured |
| GHSA-8mgp-746c-j5xp | high | nltk@3.9.4 | NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots |
| GHSA-97qj-x29f-37w7 | high | nltk@3.9.4 | NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses |
By the numbers
| Stars | 24.8K |
|---|---|
| Forks | 2,498 |
| Contributors | 119 |
| Commits | 564 |
| Open issues | 178 |
| Open pull requests | 35 |
| Releases | 44 |
| Latest release | v3.8.6 |
| Licence | BSD-2-Clause |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 18, 2026 |
| Tracked files | 34 |
| Lines of code | 4,274 |
| Checkout size | 19 MB |
Lines by language: Python 3,588, Markdown 456, YAML 150, TOML 80.
Questions
Is WhisperX free?
Yes. WhisperX is BSD-licensed and free for any use, and the Whisper, wav2vec2 and pyannote models it downloads are free too. The speaker diarization model asks you to accept its terms on Hugging Face before the first download.
How is WhisperX different from OpenAI Whisper?
It uses Whisper's models but runs them through faster-whisper in batches, so it is much faster on a GPU, and it adds what Whisper lacks: accurate word-level timestamps through phoneme alignment, voice activity detection to cut hallucinations, and speaker labels through pyannote.
Does WhisperX work on a Mac?
Yes, on the CPU. Run it with --device cpu --compute_type int8. It does not use the Apple GPU, so it is slower than on an NVIDIA card; for long files on a Mac, whisper.cpp is often faster, though it lacks WhisperX's alignment and speaker labels.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.
