Vulnerability · Published Mar 20, 2024 · Assigned by GitHub_M

CVE-2024-29032`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Medium 5.3

In plain English

A medium-severity unsafe deserialization in qiskit-ibm-runtime from Qiskit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 68.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	qiskit-ibm-runtime	0.21.2	GHSA-x4x5-jv3x-9c7m
PyPI	qiskit-ibm-runtime	0.21.2	PYSEC-2026-1858

Affected products (as reported)

Vendor	Product	Versions
Qiskit	qiskit-ibm-runtime	>= 0.1.0, < 0.21.2

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-x4x5-jv3x-9c7m x_refsource_CONFIRM
https://github.com/Qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d x_refsource_MISC
https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159 x_refsource_MISC