GHSA-cq96-9974-v8hm: 
Python vulnerability analysis and mitigation

A security vulnerability was discovered in qiskit-ibm-runtime Python package affecting versions >=0.11.0 and <0.11.1. The vulnerability involves an unsafe eval() method in Options.getprogram_inputs, which could potentially lead to arbitrary code injection in runtime containers. The issue was patched in version 0.11.1 (GitHub Advisory).

The vulnerability exists in the Options.getprograminputs method where an eval() function is used to process couplingmap values. The issue is particularly concerning because Options are used server-side, creating potential security risks. The vulnerability has been assigned a CVSS v3.1 score of 2.8 (Low severity) with a vector string of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. The weakness is categorized as CWE-627 (GitHub Advisory).

The vulnerability could allow for security breaches through arbitrary code injection in runtime containers. While the impact is classified as low severity, it could potentially affect the integrity of the system without compromising confidentiality or availability (GitHub Advisory).

The vulnerability has been patched in version 0.11.1 of qiskit-ibm-runtime. Users are advised to upgrade to this version or later to mitigate the security risk (GitHub Advisory).