https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:30:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336206 EUVD-2026-336206 https://cve.radiocsirt.org/vuln/euvd-2026-336206 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53657 <p>Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.</p> <p>Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53657 https://cve.radiocsirt.org/vuln/ghsa-2j9v-p4xj-cjw2 <p><strong>Affected:</strong> Go: github.com/lima-vm/lima/v2</p> <p>### Impact On an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guestagent.sock` when the guest agent is enabled.</p> <p>This could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lima-guestagent.sock` provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.</p> <p>This vulnerability is not exploitable on `vz` driver, as the guest agent uses vsocks instead of Unix sockets.</p> <p>### Patches Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)</p> <p>&gt; [!NOTE] &gt; The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. &gt; This is not a vulnerability, as the user can already run an arbitrary command with `sudo` by design.</p> <p>### Workarounds - On macOS hosts, use `vz` driver instead of `qemu` (`limactl create --vm-type=vz`. Default since v1.0.) - Or, disable the guest agent (`limactl create --plain`)</p> <p><strong>Affected:</strong> Go: github.com/lima-vm/lima/v2</p> <p>### Impact On an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guestagent.sock` when the guest agent is enabled.</p> <p>This could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lima-guestagent.sock` provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.</p> <p>This vulnerability is not exploitable on `vz` driver, as the guest agent uses vsocks instead of Unix sockets.</p> <p>### Patches Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)</p> <p>&gt; [!NOTE] &gt; The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. &gt; This is not a vulnerability, as the user can already run an arbitrary command with `sudo` by design.</p> <p>### Workarounds - On macOS hosts, use `vz` driver instead of `qemu` (`limactl create --vm-type=vz`. Default since v1.0.) - Or, disable the guest agent (`limactl create --plain`)</p> https://cve.radiocsirt.org/vuln/ghsa-2j9v-p4xj-cjw2