`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Summarydeserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string DetailsRuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one ca...

PT-2024-22685

Name of the Vulnerable Software and Affected Versions Qiskit IBM Runtime versions 0.1.0 through 0.21.1 Description The issue concerns the deserialization of JSON data using qiskit ibm runtime.RuntimeDecoder, which can lead to arbitrary code execution given a correctly formatted input string. This...