Lin Hsin Hsin Intelligence Center
Post-Quantum Cryptography
👑
              🦖






Complete Qiskit Module Vulnerability Matrix
August 2026






Scope: All Core SDK, Domain Apps, Official Addons, and Infrastructure modules




Category Module / Package Function Critical Findings (CVSS) Vulnerability Vector / Notes
DOMAIN APPLICATIONS (Specialized Libraries)
Domain Apps qiskit-nature Quantum Chemistry & Physics (Molecules, Lattices) 1 CRITICAL (Supply Chain) Inherits pyscf eval() risks (CWE-94) via molecule file parsing; inherits Core QASM risks.
Domain Apps qiskit-machine-learning Quantum Kernels, QNNs, Datasets 1 CRITICAL (CVSS 9.8) CWE-502 (RCE via dill.load()). Malicious model files (.dill) execute arbitrary code.
Domain Apps qiskit-finance Portfolio Optimization, Ising Translators 0 CRITICAL, High Inherits Core SDK QASM injection risks; no unique critical C++ flaws.
Domain Apps qiskit-optimization DOCplex modeling, Quadratic Programs 0 CRITICAL, High Inherits Core SDK QASM injection risks; no unique critical C++ flaws.
Domain Apps qiskit-algorithms Standalone VQE, QAOA, Grover, Amplitude Estimation 0 CRITICAL Logic errors only; no memory safety or deserialization issues found.
Domain Apps qiskit-experiments Calibration, Characterization, Tomography (Ignis successor) 0 CRITICAL, High Unsafe deserialization in calibration data files; inherits Core QASM risks.
Domain Apps qiskit-fermions (New v2.5) Fermionic Systems, Jordan-Wigner Mapping 0 CRITICAL, High Inherits Core QASM injection risks via transpiler; new module (July 2026).






Qiskit Module Vulnerabilities -- Core SDK

Qiskit Module Vulnerabilities -- Domain Apps

Qiskit Module Vulnerabilities -- AddOn