QISKIT-TERRA · CVE-2025-2000 · Package
FIX → 1.4.2 · 2.0.0rc2
Qiskit's qpy.load() function deserializes QPY formats below version 13 without safe checks, so a malicious QPY file can embed Python code that runs when a process loads it. An attacker who gets a crafted file to a loading process runs code with that process's permissions.
first public Mar 14, 2025 · 1 source
Running Qiskit-terra? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any Python process that calls qiskit.qpy.load() on a QPY file it did not create itself is exposed, since the file can carry code that runs during deserialization. Programs that only write QPY files, or that load files only they produced, are less exposed. Teams that never call the QPY loader can skip it.
Not affected if no-qpy-load, trusted-files-only
Who cares cwe-502, python, qiskit, quantum-computing
pip show qiskit and pip show qiskit-terra to see installed versions.qiskit.qpy.load() that read files from untrusted sources.A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.
Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
Upgrade to 1.4.2 · 2.0.0rc2
qiskit upgrade to 1.4.2 or later (1.x line)qiskit 2.0.0rc1 upgrade to 2.0.0rc2qiskit-terra fixed version unknownThis page as .md · .json · in your agent: get_signal("CVE-2025-2000") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.