CVE-2024-29032 `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
Attackers can execute arbitrary code by providing malicious JSON input to the RuntimeDecoder in the Qiskit IBM Runtime library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29032?
CVE-2024-29032 is a medium-severity unsafe deserialization vulnerability in qiskit-ibm-runtime, published on 20 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.
Weakness: CWE-502
Which versions are affected by CVE-2024-29032?
3 open source packages ship an affected version, including qiskit-ibm-runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qiskit-ibm-runtime PyPI | From 0.1.0 | 0.21.2 |
qiskit-ibm-runtime PyPI | From 0.1.0 | 0.21.2 |
qiskit-ibm-runtime PyPI | From 0.1.0 | 0.21.2 |
Products include Ibm Qiskit Ibm Runtime.
How do I fix CVE-2024-29032?
Upgrade qiskit-ibm-runtime to 0.21.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-29032 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29032 exists.
Sources
Also known as GHSA-x4x5-jv3x-9c7m, PYSEC-2026-1858.