Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access
JFrog's 'ParaShells' research details CVE-2026-90894, a Parallels Desktop local privilege escalation letting unprivileged macOS users gain root via tar argument injection.
JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 ('ParaShells'), a critical local privilege escalation flaw demonstrated against Parallels Desktop 26.4.0 build 57513 on Apple silicon. The world-writable /var/run/prl_disp_service.socket accepts connections from unsigned clients, and argument injection into a tar extraction command via the --use-compress-program option executes attacker-controlled code with root privileges. The attack needs no administrator permissions, running VM, or Parallels-signed client, and a one-line PoC yielded a root shell. Risk is highest on developer workstations, shared training systems, and enterprise Macs.
- CVE-2026-90894 lets unprivileged local users execute code as root
- World-writable prl_disp_service.socket accepts unsigned client connections
- tar --use-compress-program argument injection executes attacker code with root privileges
- No admin rights, running VM, or signed Parallels app required
- Exploitable via compromised npm packages, malicious installers, or poisoned CI workflows
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-90894 | Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection Parallels Desktop on macOS runs its prl_disp_service daemon as root and exposes it on the world-writable Unix socket /var/run/prl_disp_service.socket, where PrlSrv_LoginLocal authenticates clients purely on peer credentials without checking for a Parallels signature or administrator group membership. Once connected, any local user can call PrlSrv_InstallAppliance and supply an appliance folder path (sVmParentPath) that gets embedded in the command string tar -xf "%1" -C "%2"; because Qt's QProcess::splitCommand re-splits the string into words, an embedded quote closes the argument early and turns leftover text into attacker-chosen tar flags. macOS tar's --use-compress-program option then executes the named program, giving the attacker arbitrary code execution as root — a full local privilege escalation from any unprivileged account on the Mac. All Macs running an affected Parallels Desktop build (the advisory does not specify version ranges) with additional local user accounts are exposed. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time. Do: Update Parallels Desktop to the newest available release as soon as the vendor ships a fix — no patched version is named in this advisory, so check the Parallels security bulletin directly. Until patched, treat any Mac running Parallels Desktop with local untrusted or shared accounts (e.g., guest, student lab, or kiosk logins) as exposed to full root compromise, and restrict local account creation on those machines. Monitor prl_disp_service for unexpected child processes, particularly tar invocations carrying --use-compress-program or odd -C paths from appliance installs. | 7.8 | — |
| masslikely millions of Macs (Parallels Desktop is the leading commercial macOS virtualization product; no affected-version install counts published) |
Full article558 words · extracted from gbhackers.com · click to collapse
A critical local privilege escalation vulnerability in Parallels Desktop could allow an unprivileged macOS user or a malicious process to gain root-level access to the host system.
The issue, tracked as CVE-2026-90894, was disclosed by Yuval Moravchick from JFrog’s Vulnerability Research team and has been named “ParaShells.”
This flaw was demonstrated against Parallels Desktop version 26.4.0, build 57513, on Apple silicon systems. Researchers noted that the attack does not require administrator permissions, a running virtual machine, or a Parallels-signed client application.
Instead, a low-privileged local user can interact with Parallels’ privileged host service to execute attacker-controlled code with root privileges.
Parallels Desktop Flaw
The vulnerability centers around `prl_disp_service`, a root-level daemon in Parallels Desktop responsible for actions such as appliance installation, virtual machine registration, and networking operations.
This service communicates through the Unix domain socket located at `/var/run/prl_disp_service.socket`. On affected installations, the socket was world-writable, allowing any local process to connect to it.
JFrog researchers identified a series of issues involving weak local client authentication and argument injection during the appliance extraction workflow.
The `PrlSrv_LoginLocal` mechanism reportedly accepted connections from unsigned clients by relying on local peer credentials instead of verifying that the requesting process belonged to Parallels. This meant a non-administrative local account could invoke privileged functionality associated with appliance installation.
Another issue is how Parallels constructs a command for extracting appliance archives. The vulnerable code formats a tar extraction command using a user-controlled virtual machine parent path and then passes the resulting string through Qt’s `QProcess::splitCommand` routine. By embedding quotation marks in the parent-path value, an attacker can alter the arguments supplied to the `tar` command.
This is not a conventional shell command injection. There’s no need for the shell to parse attacker-controlled semicolons, command substitutions, or chained commands. Instead, the attacker injects additional options for `tar` into the argument list.
Researchers demonstrated an abuse of the `–use-compress-program` option, which causes `tar` to launch an external program while processing an archive. Because `prl_disp_service` invokes `tar` with root privileges, that external program also executes with root access.
The attack chain begins with local access to a Mac running the vulnerable version of Parallels Desktop. An attacker can provide a crafted appliance package, authenticate to the dispatcher as an ordinary user, and supply a manipulated installation path.
Even if the appliance installation later reports an extraction error, the injected program may have already executed with elevated privileges.
The risk is particularly significant for developer workstations, shared training systems, and enterprise Macs where Parallels Desktop is installed.
A compromised npm package, a malicious installer, a poisoned CI workflow, or other code executing under a standard user account could potentially exploit this flaw to take control of the underlying host.
Administrators should identify systems running Parallels Desktop 26.4.0 build 57513 or similar versions, check the permissions on `prl_disp_service.socket`, and apply vendor updates as soon as they become available.
Organizations should also monitor for suspicious appliance installation activity, unexpected `tar` child processes, anomalous root-owned scripts, and unauthorized modifications to `sudoers` or `launchd` persistence locations.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/parallels-desktop-flaw/