Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.
- Tracked as CVE-2026-90894, the flaw chains a world-writable socket, weak client authentication, and tar argument injection.
- The prl_disp_service root daemon accepts unsigned local clients and runs attacker-controlled tar programs.
- A one-line PoC from JFrog yields a root shell; no running VM required.
- Fixed in Parallels Desktop 27.0.0; admins should inventory and upgrade affected builds.
- CVEs
- CVE-2026-90894
- Tags
- apple-siliconargument-injectionjfroglpemacosparallels-desktopprivilege-escalationprl-disp-service
- Vendors
- Parallels DesktopAppleJFrog
- Products
- Parallels Desktop
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90894 | Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection | 7.8 | — |
From the original article
2 min read at cybersecuritynews.com
A critical local privilege escalation vulnerability in Parallels Desktop for Mac could allow a non-administrator user or unprivileged process to execute attacker-controlled code with root privileges. Tracked as CVE-2026-90894 and called “ParaShells,” the vulnerability was confirmed in Parallels Desktop 26. 4.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.