Story · 4 sources · 4 articlesfirst Sep 16, 09:24 UTCupdated Sep 16, 13:14 UTC (2h ago)

Parallels Desktop Flaw Lets Non-Admin Mac Users Execute Code as Root, but Intel Macs Cannot Install the Fix (CVE-2026-90894)

highVulnerabilityimportance 62CVE-2026-90894

What's new: The earlier summary is updated with details from the latest report (The Hacker News): CVE-2026-90894 carries a CVSS score of 7.8; the injection path additionally involves QProcess::splitCommand; and, importantly, the fix ships only in Parallels Desktop 27.0.0, which requires Apple silicon — meaning Intel Macs on the 26.x line cannot install any build JFrog describes as fixed. The report also…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

JFrog disclosed CVE-2026-90894 ('ParaShells'), a critical, CVSS 7.8-rated local privilege escalation in Parallels Desktop for macOS that chains a world-writable socket, weak peer-credential authentication, and tar argument injection to let any non-admin local…

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894, dubbed 'ParaShells', a critical local privilege escalation (CVSS 7.8 per The Hacker News) in Parallels Desktop for macOS. The privileged prl_disp_service launch daemon, which runs as root and starts automatically on load, accepts connections from unsigned local clients through the world-writable /var/run/prl_disp_service.socket with weak peer-credential authentication. Argument injection into a tar extraction command during appliance installation — via QProcess::splitCommand and the --use-compress-program option — causes tar to execute an attacker-controlled program with root privileges. The attack requires no administrator permissions, no running virtual machine, and no Parallels-signed client; JFrog's one-line proof of concept yielded a root shell, though the PoC script was withheld from publication. The flaw was demonstrated against Parallels Desktop 26.4.0 build 57513 on Apple silicon and was fixed by Alludo in version 27.0.0 in early September 2026. However, The Hacker News reports that Parallels Desktop 27 requires Apple silicon, so Intel Macs on the 26.x line have no build JFrog describes as fixed; Parallels has not published a statement. No exploitation in the wild has been reported. From root, attackers could replace system software, read other users' data, and persist via launchd. GBHackers notes risk is highest on developer workstations, shared training systems, and enterprise Macs, and that exploitation could occur via compromised npm packages, malicious installers, or poisoned CI workflows. Administrators are advised to inventory Macs running Parallels, upgrade to version 27.0.0 or later, and restrict local account access.

CVE-2026-90894, dubbed 'ParaShells', is a local privilege escalation in Parallels Desktop for macOS rated CVSS 7.8 (The Hacker News); sources describe it as critical.
Discovered by JFrog researcher Yuval Moravchick and demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon.
The root-level prl_disp_service launch daemon runs as root, starts automatically on load, and listens on the world-writable /var/run/prl_disp_service.socket, accepting unsigned local clients with weak peer-credential authentication.
Argument injection into a tar extraction command during appliance installation via the --use-compress-program option makes tar execute an attacker-controlled program as root (The Hacker News also cites QProcess::splitCommand in the…
No admin rights, running VM, or Parallels-signed client are required; a one-line PoC yielded a root shell, but JFrog withheld the PoC script.
From root, attackers can replace system software, read other users' data, and persist via launchd.
Fixed by Alludo in Parallels Desktop 27.0.0 in early September 2026; per The Hacker News, version 27 requires Apple silicon, so Intel Macs on the 26.x line have no build JFrog describes as fixed.
No exploitation in the wild has been reported; Parallels has not published a statement.

VendorsAlludo Parallels JFrog Apple Parallels Desktop

ProductsParallels Desktop macOS

OrganizationsJFrog Parallels

Coverage timelineoldest first · each row is one article

09:24 UTC · 6h ago
Cyber Security News· 62
Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
11:29 UTC · 4h ago
GBHackers· 58
Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access
JFrog's 'ParaShells' research details CVE-2026-90894, a Parallels Desktop local privilege escalation letting unprivileged macOS users gain root via tar argument injection.
12:36 UTC · 3h ago
Help Net Security· 62
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.
13:14 UTC · 2h ago
The Hacker News· 52
Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix
JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-90894	Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection Parallels Desktop on macOS runs its prl_disp_service daemon as root and exposes it on the world-writable Unix socket /var/run/prl_disp_service.socket, where PrlSrv_LoginLocal authenticates clients purely on peer credentials without checking for a Parallels signature or administrator group membership. Once connected, any local user can call PrlSrv_InstallAppliance and supply an appliance folder path (sVmParentPath) that gets embedded in the command string tar -xf "%1" -C "%2"; because Qt's QProcess::splitCommand re-splits the string into words, an embedded quote closes the argument early and turns leftover text into attacker-chosen tar flags. macOS tar's --use-compress-program option then executes the named program, giving the attacker arbitrary code execution as root — a full local privilege escalation from any unprivileged account on the Mac. All Macs running an affected Parallels Desktop build (the advisory does not specify version ranges) with additional local user accounts are exposed. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time. Do: Update Parallels Desktop to the newest available release as soon as the vendor ships a fix — no patched version is named in this advisory, so check the Parallels security bulletin directly. Until patched, treat any Mac running Parallels Desktop with local untrusted or shared accounts (e.g., guest, student lab, or kiosk logins) as exposed to full root compromise, and restrict local account creation on those machines. Monitor prl_disp_service for unexpected child processes, particularly tar invocations carrying --use-compress-program or odd -C paths from appliance installs.	7.8	—		Parallels (Alludo) Parallels Desktop for Mac	masslikely millions of Macs (Parallels Desktop is the leading commercial macOS virtualization product; no affected-version install counts published)	2d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-90894

Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection

Parallels Desktop on macOS runs its prl_disp_service daemon as root and exposes it on the world-writable Unix socket /var/run/prl_disp_service.socket, where PrlSrv_LoginLocal authenticates clients purely on peer credentials without checking for a Parallels signature or administrator group membership. Once connected, any local user can call PrlSrv_InstallAppliance and supply an appliance folder path (sVmParentPath) that gets embedded in the command string tar -xf "%1" -C "%2"; because Qt's QProcess::splitCommand re-splits the string into words, an embedded quote closes the argument early and turns leftover text into attacker-chosen tar flags. macOS tar's --use-compress-program option then executes the named program, giving the attacker arbitrary code execution as root — a full local privilege escalation from any unprivileged account on the Mac. All Macs running an affected Parallels Desktop build (the advisory does not specify version ranges) with additional local user accounts are exposed. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Update Parallels Desktop to the newest available release as soon as the vendor ships a fix — no patched version is named in this advisory, so check the Parallels security bulletin directly. Until patched, treat any Mac running Parallels Desktop with local untrusted or shared accounts (e.g., guest, student lab, or kiosk logins) as exposed to full root compromise, and restrict local account creation on those machines. Monitor prl_disp_service for unexpected child processes, particularly tar invocations carrying --use-compress-program or odd -C paths from appliance installs.

7.8

—

Parallels (Alludo) Parallels Desktop for Mac

masslikely millions of Macs (Parallels Desktop is the leading commercial macOS virtualization product; no affected-version install counts published)

2d ago