Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

Key Takeaways

• A critical local privilege escalation (LPE) vulnerability, dubbed “ParaShells” (CVE-2026-90894), was discovered in Parallels Desktop for Mac.
• The flaw allowed unprivileged users or processes on a Mac to execute arbitrary code with root privileges.
• The vulnerability specifically affected Parallels Desktop 26.4.0 build 57513 running on Apple Silicon Macs.
• Parallels addressed the issue in version 27.0.0; immediate updates are strongly recommended for all users.

A severe local privilege escalation vulnerability has been identified in Parallels Desktop for Mac, posing a significant risk to affected systems. This flaw, tracked as CVE-2026-90894 and nicknamed “ParaShells,” could enable a non-administrative user or an unprivileged process to execute arbitrary code with full root privileges on a vulnerable macOS machine.

The vulnerability was confirmed to impact Parallels Desktop 26.4.0 build 57513, specifically on Macs equipped with Apple Silicon processors. Parallels swiftly released an update, with version 27.0.0 containing the necessary patch to mitigate this critical issue.

Understanding the “ParaShells” Vulnerability

The core of the attack targets a privileged host daemon within Parallels Desktop known as prl_disp_service. This service is designed to handle sensitive operations, including the management of virtual machines, network configurations, and the installation of virtual appliance packages. Crucially, prl_disp_service operates with root privileges, making it a high-value target for attackers if exploited.

The vulnerability arises from a combination of three distinct security weaknesses: a Unix socket with world-writable permissions, insufficient local client authentication, and an argument injection flaw during the process of extracting appliance packages. Together, these weaknesses create a direct pathway for an unprivileged entity to compromise the entire system.

The Attack Chain

By default, the prl_disp_service listens for connections via the /var/run/prl_disp_service.socket file. Jfrog Researchers found that this socket could be configured with 0777 permissions, meaning any local process could establish a connection to it.

Further compounding the issue, the PrlSrv_LoginLocal function, responsible for authenticating connections, relies solely on operating system peer credentials. It fails to verify whether the connecting client is signed by Parallels. This oversight allows an unsigned client, even one running under a standard user account, to successfully authenticate with the privileged service.

Once connected and authenticated, an attacker can invoke the PrlSrv_InstallAppliance operation. During this stage, the attacker can supply a specially crafted, malicious virtual machine parent directory path. When the service proceeds with the appliance installation, it constructs a tar extraction command, incorporating the attacker-controlled path values. The command’s arguments are parsed using Qt’s QProcess::splitCommand function.

The critical flaw lies in how arguments are processed. By embedding a quotation mark within the malicious parent path, an attacker can prematurely terminate an expected quoted value in the tar command. This allows for the injection of an additional tar option: --use-compress-program. This particular option instructs the macOS tar utility to execute an external program while it processes the archive. Since prl_disp_service initiates the tar command as root, the attacker-controlled program specified by --use-compress-program also executes with root privileges.

It is important to note that this attack leverages argument injection, not traditional shell command injection. This distinction means that shell metacharacters are not necessary; the attacker directly manipulates the argument list passed to the tar command.

Exploitation of this vulnerability does not require a virtual machine to be running. The only prerequisites are the presence of Parallels Desktop, an active privileged prl_disp_service and its socket, and access to a low-privileged local user account on the Mac.

Potential sources for initiating such an attack include malicious software packages, compromised continuous integration pipelines, tainted npm installation scripts, Homebrew formulas, or any other code already executing under a standard user account on the system.

Successful exploitation grants attackers extensive control over the affected Mac. This includes the ability to access other users’ files, modify system software, install persistent launch daemons, alter sudo configurations, and ultimately achieve complete system compromise.

What You Should Do

• Immediately Update: Administrators and users of Parallels Desktop for Mac should upgrade to version 27.0.0 or later without delay.
• Verify Installation: Check your installed Parallels Desktop version via the “About” window or by inspecting the application’s CFBundleShortVersionString and CFBundleVersion values.
• Monitor for Exposure: Systems running build 57513 with a world-writable prl_disp_service.socket should be considered exposed until the update is confirmed.
• Restrict Local Access: As a temporary measure until updates can be fully deployed, organizations should consider restricting local account access and closely monitoring systems that expose the dispatcher socket.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.