Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

A critical local privilege escalation vulnerability in Parallels Desktop could allow an unprivileged macOS user or a malicious process to gain root-level access to the host system.

The issue, tracked as CVE-2026-90894, was disclosed by Yuval Moravchick from JFrog’s Vulnerability Research team and has been named “ParaShells.”

This flaw was demonstrated against Parallels Desktop version 26.4.0, build 57513, on Apple silicon systems. Researchers noted that the attack does not require administrator permissions, a running virtual machine, or a Parallels-signed client application.

Instead, a low-privileged local user can interact with Parallels’ privileged host service to execute attacker-controlled code with root privileges.

Parallels Desktop Flaw

The vulnerability centers around `prl_disp_service`, a root-level daemon in Parallels Desktop responsible for actions such as appliance installation, virtual machine registration, and networking operations.

This service communicates through the Unix domain socket located at `/var/run/prl_disp_service.socket`. On affected installations, the socket was world-writable, allowing any local process to connect to it.

JFrog researchers identified a series of issues involving weak local client authentication and argument injection during the appliance extraction workflow.

The `PrlSrv_LoginLocal` mechanism reportedly accepted connections from unsigned clients by relying on local peer credentials instead of verifying that the requesting process belonged to Parallels. This meant a non-administrative local account could invoke privileged functionality associated with appliance installation.

Another issue is how Parallels constructs a command for extracting appliance archives. The vulnerable code formats a tar extraction command using a user-controlled virtual machine parent path and then passes the resulting string through Qt’s `QProcess::splitCommand` routine. By embedding quotation marks in the parent-path value, an attacker can alter the arguments supplied to the `tar` command.

This is not a conventional shell command injection. There’s no need for the shell to parse attacker-controlled semicolons, command substitutions, or chained commands. Instead, the attacker injects additional options for `tar` into the argument list.

Researchers demonstrated an abuse of the `–use-compress-program` option, which causes `tar` to launch an external program while processing an archive. Because `prl_disp_service` invokes `tar` with root privileges, that external program also executes with root access.

The attack chain begins with local access to a Mac running the vulnerable version of Parallels Desktop. An attacker can provide a crafted appliance package, authenticate to the dispatcher as an ordinary user, and supply a manipulated installation path.

Even if the appliance installation later reports an extraction error, the injected program may have already executed with elevated privileges.

The risk is particularly significant for developer workstations, shared training systems, and enterprise Macs where Parallels Desktop is installed.

A compromised npm package, a malicious installer, a poisoned CI workflow, or other code executing under a standard user account could potentially exploit this flaw to take control of the underlying host.

Administrators should identify systems running Parallels Desktop 26.4.0 build 57513 or similar versions, check the permissions on `prl_disp_service.socket`, and apply vendor updates as soon as they become available.

Organizations should also monitor for suspicious appliance installation activity, unexpected `tar` child processes, anomalous root-owned scripts, and unauthorized modifications to `sudoers` or `launchd` persistence locations.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC