GHSA-6m2c-76ff-6vrf
First published: Fri Mar 14 2025(Updated: )
### Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload. ### Patches Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/qiskit | =2.0.0rc1 | 2.0.0rc2 |
| pip/qiskit | <=1.4.1 | 1.4.2 |
| pip/qiskit-terra | >=0.18.0<=0.46.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of GHSA-6m2c-76ff-6vrf?
GHSA-6m2c-76ff-6vrf is classified as a high severity vulnerability due to the potential for arbitrary code execution.
How do I fix GHSA-6m2c-76ff-6vrf?
To fix GHSA-6m2c-76ff-6vrf, upgrade to qiskit version 1.4.2 or later, or qiskit-terra version outside the vulnerable range.
What versions are affected by GHSA-6m2c-76ff-6vrf?
GHSA-6m2c-76ff-6vrf affects qiskit versions up to and including 1.4.1 and qiskit-terra versions between 0.18.0 and 0.46.3.
What is the nature of the vulnerability in GHSA-6m2c-76ff-6vrf?
GHSA-6m2c-76ff-6vrf allows for arbitrary code execution through the deserialization of maliciously crafted QPY files.
What happens if I am using an affected version related to GHSA-6m2c-76ff-6vrf?
If using an affected version, your application may be vulnerable to executing malicious code, which could compromise its security.
- agent/weakness
- agent/severity
- agent/references
- agent/source
- agent/type
- agent/first-publish-date
- agent/tags
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6m2c-76ff-6vrf
- alias/CVE-2025-2000
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- collector/github-advisory
- agent/event
- package-manager/pip