GitHub Advisoryadvisory · PyPI

GHSA-6m2c-76ff-6vrf Qiskit allows arbitrary code execution decoding QPY format versions < 13

CRITICAL Published 2025-03-14 Modified 2025-05-02 Official page ↗
Aliases
CVE-2025-2000
Ecosystem
PyPI
Packages
qiskit-terra, qiskit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2025-03-14

Affected packages

• PyPI qiskit-terra: >= 0.18.0, <= 0.46.3 (no fix yet) • PyPI qiskit: < 1.4.2 → fixed in 1.4.2 • PyPI qiskit: >= 2.0.0rc1, < 2.0.0rc2 → fixed in 2.0.0rc2

Description

Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload. Patches Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Related

Alias · CVE (1)

  • CVE-2025-2000 A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References