lima-vm vulnerabilities and threats

CVE-2026-53657 is a vulnerability in lima-vm's lima product versions prior to 2.1.3. When running with the qemu driver and the guest agent enabled, an arbitrary user inside the VM can access the guest agent socket (/run/lima-guestagent.sock), potentially allowing execution of arbitrary commands with root privileges inside the VM. This issue does not affect the vz driver, which uses vsocks instead of Unix sockets. The vulnerability is patched in version 2.1.3. The default user in the VM can already run commands as root via sudo, so this behavior is not considered a vulnerability by design. Workarounds include using the vz driver or disabling the guest agent.