CVE-2026-53657 with a CVSS score of 8.2 is a vulnerability affecting github.com/lima-vm/lima/v2 versions <= 2.1.2 in Lima where an arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket, allowing them to run an arbitrary command with root privileges in the VM, not on the host, by accessing when the guest agent is enabled; this is exploitable due to the tunneling service for an arbitrary address provided by lima-guestagent.sock, which includes a Unix socket address for privileged daemons like D-Bus; however, it is not exploitable on vz driver as the guest agent uses vsocks instead of Unix sockets; the default user account in the VM can still run an arbitrary command as the root via the guest agent socket, but this is not a vulnerability as the user can already run an arbitrary command with sudo by design; affected versions are prior to 2.1.3.
We recommend you to update Lima to version 2.1.3.[/subscribe_to_unlock_form]
CVE-2026-53657 with a CVSS score of 8.2 is a vulnerability affecting github.com/lima-vm/lima/v2 versions <= 2.1.2 in Lima where an arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket, allowing them to run an arbitrary command with root privileges in the VM, not on the host, by accessing when the guest agent is enabled; this is exploitable due to the tunneling service for an arbitrary address provided by lima-guestagent.sock, which includes a Unix socket address for privileged daemons like D-Bus; however, it is not exploitable on vz driver as the guest agent uses vsocks instead of Unix sockets; the default user account in the VM can still run an arbitrary command as the root via the guest agent socket, but this is not a vulnerability as the user can already run an arbitrary command with sudo by design; affected versions are prior to 2.1.3.
We recommend you to update Lima to version 2.1.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]