{"schema_version":"1.9.0","id":"GHSA-2j9v-p4xj-cjw2","published":"2026-08-14T19:24:33Z","modified":"2026-08-18T15:10:49.812420050Z","aliases":["CVE-2026-53657","GO-2026-6230"],"summary":"Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket","details":"### Impact\nOn an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guestagent.sock` when the guest agent is enabled.\n\nThis could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lima-guestagent.sock` provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.\n\nThis vulnerability is not exploitable on `vz` driver, as the guest agent uses vsocks instead of Unix sockets.\n\n### Patches\nPatched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)\n\n> [!NOTE]\n> The default user account in the VM can still run an arbitrary command as the root via the guest agent socket.\n> This is not a vulnerability, as the user can already run an arbitrary command with `sudo` by design.\n\n### Workarounds\n- On macOS hosts, use `vz` driver instead of `qemu` (`limactl create --vm-type=vz`. Default since v1.0.)\n- Or, disable the guest agent (`limactl create --plain`)","affected":[{"package":{"name":"github.com/lima-vm/lima/v2","ecosystem":"Go","purl":"pkg:golang/github.com/lima-vm/lima/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 2.1.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2j9v-p4xj-cjw2/GHSA-2j9v-p4xj-cjw2.json"}}],"references":[{"type":"WEB","url":"https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53657"},{"type":"WEB","url":"https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50"},{"type":"WEB","url":"https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678"},{"type":"PACKAGE","url":"https://github.com/lima-vm/lima"},{"type":"WEB","url":"https://github.com/lima-vm/lima/releases/tag/v2.1.3"}],"database_specific":{"cwe_ids":["CWE-276","CWE-668"],"github_reviewed":true,"github_reviewed_at":"2026-08-14T19:24:33Z","nvd_published_at":"2026-07-10T17:16:57Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}