GHSA-2j9v-p4xj-cjw2

Source

https://github.com/advisories/GHSA-2j9v-p4xj-cjw2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2j9v-p4xj-cjw2/GHSA-2j9v-p4xj-cjw2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2j9v-p4xj-cjw2

Aliases

Published

2026-08-14T19:24:33Z

Modified

2026-08-18T15:10:49Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Details

Impact

On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.

This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.

This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.

Patches

Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)

[!NOTE] The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. This is not a vulnerability, as the user can already run an arbitrary command with sudo by design.

Workarounds

On macOS hosts, use vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.)
Or, disable the guest agent (limactl create --plain)

Database specific

{
    "cwe_ids":  [
        "CWE-276",
        "CWE-668"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-14T19:24:33Z",
    "nvd_published_at":  "2026-07-10T17:16:57Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/lima-vm/lima/v2

Package

Name: github.com/lima-vm/lima/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/lima-vm/lima/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.3

Database specific

last_known_affected_version_range

"<= 2.1.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2j9v-p4xj-cjw2/GHSA-2j9v-p4xj-cjw2.json"