| id: GO-2026-6230 | |
| modules: | |
| - module: github.com/lima-vm/lima | |
| vulnerable_at: 1.2.3 | |
| - module: github.com/lima-vm/lima/v2 | |
| versions: | |
| - fixed: 2.1.3 | |
| vulnerable_at: 2.1.2 | |
| summary: |- | |
| Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via | |
| the guest agent socket in github.com/lima-vm/lima | |
| cves: | |
| - CVE-2026-53657 | |
| ghsas: | |
| - GHSA-2j9v-p4xj-cjw2 | |
| references: | |
| - advisory: https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2 | |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-53657 | |
| - fix: https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50 | |
| - fix: https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678 | |
| - web: https://github.com/lima-vm/lima/releases/tag/v2.1.3 | |
| source: | |
| id: GHSA-2j9v-p4xj-cjw2 | |
| created: 2026-08-17T22:52:51.077388-04:00 | |
| review_status: UNREVIEWED |