HIGH 8.2 GitHub
CVE-2026-53657
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
### Impact
On an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guestagent.sock` when the guest agent is enabled.
This could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lima-guestagent.sock` provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.
This vulnerability is not exploitable on `vz` driver, as the guest agent use
Affected Products
- go/github.com/lima-vm/lima/v2 <= 2.1.2
References
- https://github.com/advisories/GHSA-2j9v-p4xj-cjw2
- https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2
- https://nvd.nist.gov/vuln/detail/CVE-2026-53657
- https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-08-14 via GitHub. Affected: go/github.com/lima-vm/lima/v2 <= 2.1.2.
vulnfeed aggregates 10939 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.