| Package | Affected versions | Patched versions |
|---|---|---|
| qiskit | ≥ 2.0.0rc1, < 2.0.0rc2< 1.4.2 | 2.0.0rc21.4.2 |
| qiskit-terra | ≥ 0.18.0, ≤ 0.46.3 | |
| qiskit | ≥ 0.18.0, < 1.4.2 | 1.4.2 |
A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.
Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free