Vulnerability Description
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50
- https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678
- https://github.com/lima-vm/lima/releases/tag/v2.1.3
- https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2
FAQ
What is CVE-2026-53657?
CVE-2026-53657 is a vulnerability with a CVSS score of 8.2 (HIGH). Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lim...
How severe is CVE-2026-53657?
CVE-2026-53657 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53657?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.