A critical local privilege escalation vulnerability in Parallels Desktop for Mac could allow a non-administrator user or unprivileged process to execute attacker-controlled code with root privileges.
Tracked as CVE-2026-90894 and called “ParaShells,” the vulnerability was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon Macs. Parallels addressed the issue with the release of version 27.0.0.
The attack targets prl_disp_service, a privileged host daemon used by Parallels Desktop to perform sensitive operations such as managing virtual machines, configuring networking, and installing appliance packages.
Because the service runs as root, unsafe requests sent to it may provide a direct path to complete system compromise. The vulnerability combines three security weaknesses: a world-writable Unix socket, weak local client authentication, and argument injection during appliance extraction.
Parallels Desktop Vulnerability
On a default installation, prl_disp_service listens through /var/run/prl_disp_service.socket. Jfrog Researchers found that the socket could have 0777 permissions, allowing any local process to connect.
The PrlSrv_LoginLocal function reportedly accepts connections based on operating system peer credentials instead of confirming that Parallels signed the client. As a result, an unsigned client running under a standard user account could authenticate successfully.
After connecting, an attacker can invoke the PrlSrv_InstallAppliance operation and provide a malicious virtual machine parent directory path.
During appliance installation, the service constructs a tar extraction command using attacker-controlled path values. The command is split into arguments through Qt’s QProcess::splitCommand function.
By placing a quotation mark inside the parent path, an attacker can terminate the expected quoted value and inject an additional tar option.
The injected option, –use-compress-program, instructs macOS tar to launch an external program while processing the archive. Since prl_disp_service starts tar as root, the attacker-controlled program also runs with root privileges.
This is argument injection rather than traditional shell command injection. Shell metacharacters are unnecessary because the attacker manipulates the argument list passed directly to tar.
A running virtual machine is not required. The demonstrated exploit only needs Parallels Desktop, the active privileged service and socket, and access to a low-privileged local account.
Potential attack sources include malicious software packages, compromised continuous integration jobs, poisoned npm installation scripts, Homebrew formulas, or other code already executing as a standard user.
Successful exploitation could allow attackers to access other users’ files, modify system software, install persistent launch daemons, alter sudo configuration, and fully control the affected Mac.
Administrators should inventory systems running Parallels Desktop and immediately upgrade affected installations to version 27.0.0 or later. Until updates can be deployed, organizations should restrict local account access and closely monitor systems exposing the dispatcher socket.
Users can check the installed version through the Parallels Desktop About window or inspect the application’s CFBundleShortVersionString and CFBundleVersion values. Systems running build 57513 with a world-writable prl_disp_service.socket should be treated as exposed until remediation is confirmed.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root appeared first on Cyber Security News.