---
id: "CVE-2025-2000"
kind: "vulnerability"
aliases: ["CVE-2025-2000", "GHSA-6m2c-76ff-6vrf"]
title: "Qiskit allows arbitrary code execution decoding QPY format versions < 13"
severity: "critical"
cvss: 9.8
epss: 0.0081
exploited: false
status: "open"
category: "package"
products: [{"name": "qiskit-terra", "fixed": [], "affected": ">= 0.18.0, <= 0.46.3", "ecosystem": "pypi"}, {"name": "qiskit", "fixed": ["1.4.2"], "affected": "<= 1.4.1", "ecosystem": "pypi"}, {"name": "qiskit", "fixed": ["2.0.0rc2"], "affected": "= 2.0.0rc1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-502", "package", "python", "qiskit", "quantum-computing"]
not_affected_if: ["no-qpy-load", "trusted-files-only"]
published_at: "2025-03-14T19:56:14+00:00"
first_seen_at: "2026-11-04T16:29:22+00:00"
updated_at: "2026-11-04T16:30:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6m2c-76ff-6vrf", "first_seen_at": "2026-11-04T16:29:22+00:00"}]
---

# Qiskit allows arbitrary code execution decoding QPY format versions < 13

Qiskit's qpy.load() function deserializes QPY formats below version 13 without safe checks, so a malicious QPY file can embed Python code that runs when a process loads it. An attacker who gets a crafted file to a loading process runs code with that process's permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:qiskit-terra affected >= 0.18.0, <= 0.46.3 fixed ?
- pypi:qiskit affected <= 1.4.1 fixed 1.4.2
- pypi:qiskit affected = 2.0.0rc1 fixed 2.0.0rc2

## How to check

- Run `pip show qiskit` and `pip show qiskit-terra` to see installed versions.
- Search your code and pipelines for calls to `qiskit.qpy.load()` that read files from untrusted sources.

## Fix

- `qiskit` upgrade to `1.4.2` or later (1.x line)
- `qiskit` `2.0.0rc1` upgrade to `2.0.0rc2`
- `qiskit-terra` fixed version unknown

## Timeline

- 2026-11-04T16:29:22+00:00 ghsa https://github.com/advisories/GHSA-6m2c-76ff-6vrf

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/Qiskit/qiskit/security-advisories/GHSA-6m2c-76ff-6vrf
- [advisory] Maintainer's advisory: github.com https://github.com/Qiskit/qiskit/security/advisories/GHSA-6m2c-76ff-6vrf

## From the sources

### Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

### Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_