Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.
- Tracked as CVE-2026-90894, the flaw chains a world-writable socket, weak client authentication, and tar argument injection.
- The prl_disp_service root daemon accepts unsigned local clients and runs attacker-controlled tar programs.
- A one-line PoC from JFrog yields a root shell; no running VM required.
- Fixed in Parallels Desktop 27.0.0; admins should inventory and upgrade affected builds.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-90894 | Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection Parallels Desktop on macOS runs its prl_disp_service daemon as root and exposes it on the world-writable Unix socket /var/run/prl_disp_service.socket, where PrlSrv_LoginLocal authenticates clients purely on peer credentials without checking for a Parallels signature or administrator group membership. Once connected, any local user can call PrlSrv_InstallAppliance and supply an appliance folder path (sVmParentPath) that gets embedded in the command string tar -xf "%1" -C "%2"; because Qt's QProcess::splitCommand re-splits the string into words, an embedded quote closes the argument early and turns leftover text into attacker-chosen tar flags. macOS tar's --use-compress-program option then executes the named program, giving the attacker arbitrary code execution as root — a full local privilege escalation from any unprivileged account on the Mac. All Macs running an affected Parallels Desktop build (the advisory does not specify version ranges) with additional local user accounts are exposed. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time. Do: Update Parallels Desktop to the newest available release as soon as the vendor ships a fix — no patched version is named in this advisory, so check the Parallels security bulletin directly. Until patched, treat any Mac running Parallels Desktop with local untrusted or shared accounts (e.g., guest, student lab, or kiosk logins) as exposed to full root compromise, and restrict local account creation on those machines. Monitor prl_disp_service for unexpected child processes, particularly tar invocations carrying --use-compress-program or odd -C paths from appliance installs. | 7.8 | — |
| masslikely millions of Macs (Parallels Desktop is the leading commercial macOS virtualization product; no affected-version install counts published) |
Full article518 words · extracted from cybersecuritynews.com · click to collapse
A critical local privilege escalation vulnerability in Parallels Desktop for Mac could allow a non-administrator user or unprivileged process to execute attacker-controlled code with root privileges.
Tracked as CVE-2026-90894 and called “ParaShells,” the vulnerability was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon Macs. Parallels addressed the issue with the release of version 27.0.0.
The attack targets prl_disp_service, a privileged host daemon used by Parallels Desktop to perform sensitive operations such as managing virtual machines, configuring networking, and installing appliance packages.
Because the service runs as root, unsafe requests sent to it may provide a direct path to complete system compromise. The vulnerability combines three security weaknesses: a world-writable Unix socket, weak local client authentication, and argument injection during appliance extraction.
Parallels Desktop Vulnerability
On a default installation, prl_disp_service listens through /var/run/prl_disp_service.socket. Jfrog Researchers found that the socket could have 0777 permissions, allowing any local process to connect.
The PrlSrv_LoginLocal function reportedly accepts connections based on operating system peer credentials instead of confirming that Parallels signed the client. As a result, an unsigned client running under a standard user account could authenticate successfully.
After connecting, an attacker can invoke the PrlSrv_InstallAppliance operation and provide a malicious virtual machine parent directory path.
During appliance installation, the service constructs a tar extraction command using attacker-controlled path values. The command is split into arguments through Qt’s QProcess::splitCommand function.
By placing a quotation mark inside the parent path, an attacker can terminate the expected quoted value and inject an additional tar option.
The injected option, –use-compress-program, instructs macOS tar to launch an external program while processing the archive. Since prl_disp_service starts tar as root, the attacker-controlled program also runs with root privileges.
This is argument injection rather than traditional shell command injection. Shell metacharacters are unnecessary because the attacker manipulates the argument list passed directly to tar.
A running virtual machine is not required. The demonstrated exploit only needs Parallels Desktop, the active privileged service and socket, and access to a low-privileged local account.
Potential attack sources include malicious software packages, compromised continuous integration jobs, poisoned npm installation scripts, Homebrew formulas, or other code already executing as a standard user.
Successful exploitation could allow attackers to access other users’ files, modify system software, install persistent launch daemons, alter sudo configuration, and fully control the affected Mac.
Administrators should inventory systems running Parallels Desktop and immediately upgrade affected installations to version 27.0.0 or later. Until updates can be deployed, organizations should restrict local account access and closely monitor systems exposing the dispatcher socket.
Users can check the installed version through the Parallels Desktop About window or inspect the application’s CFBundleShortVersionString and CFBundleVersion values. Systems running build 57513 with a world-writable prl_disp_service.socket should be treated as exposed until remediation is confirmed.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/parallels-desktop-vulnerability/