CVE-2026-53657 | Lima launches Linux virtual machines, typically on macOS, fo… | CVSS 8.2 HIGH

Description

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.

Metadata

CVE ID: CVE-2026-53657
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 20:50 UTC
Published: 2026-07-10 15:42 UTC
Last updated: 2026-07-10 15:42 UTC
Primary CWE: CWE-276
CWE-276: Incorrect Default Permissions
Vendor / Product: lima-vm / lima
Sources: cve.org · NVD

Severity & Metrics

8.2 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
lima-vm	lima	—	< 2.1.3

Weakness (CWE)

CWE	Source	Description
CWE-276	cna	CWE-276: Incorrect Default Permissions
CWE-668	cna	CWE-668: Exposure of Resource to Wrong Sphere

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.2	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References (4)

https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2 https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2
https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50 https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50
https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678 https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678
https://github.com/lima-vm/lima/releases/tag/v2.1.3 https://github.com/lima-vm/lima/releases/tag/v2.1.3