# CVE-2026-90894 ("ParaShells"): Parallels Desktop for Mac Local Privilege Escalation via Appliance Extract Argument Injection

> A local privilege escalation vulnerability in Parallels Desktop for Mac (versions below 27.0.0) lets any unprivileged local user gain root code execution. The root-owned prl_disp_service daemon exposes a world-writable (0777) Unix socket that trusts OS peer credentials instead of verifying a Parallels client signature, and its appliance-extraction RPC builds a tar command from an attacker-supplied folder name via Qt's QProcess::splitCommand, so a crafted folder name injects the tar --use-compress-program= flag to run an arbitrary program as root. JFrog Security Research (Yuval Moravchick) discovered, disclosed, and built a functional (unreleased) PoC dubbed ParaShells; Alludo/Parallels fixed it in Parallels Desktop 27.0.0.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2536
- **ID:** TL-2026-2536
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-90894

## Description

CVE-2026-90894 is a local privilege escalation (LPE) vulnerability in Parallels Desktop for Mac affecting versions prior to 27.0.0, confirmed by JFrog Security Research on Parallels Desktop 26.4.0 build 57513 and 26.4.2 running on Apple Silicon Macs. The flaw chains three separate weaknesses in the privileged host component prl_disp_service, a dispatcher daemon that runs as root to perform sensitive operations such as managing virtual machines, configuring networking, and installing appliance packages.

First, prl_disp_service listens on a Unix domain socket at /var/run/prl_disp_service.socket that is world-writable (mode 0777), so any local process can connect to it regardless of group membership. Second, the daemon's PrlSrv_LoginLocal RPC method authenticates incoming connections purely on OS-reported peer credentials (uid/gid of the connecting process) rather than verifying a Parallels client code-signature or Team ID, so any unprivileged local binary can successfully "log in" to the privileged dispatcher. Third, once authenticated, the PrlSrv_InstallAppliance RPC method lets the caller supply an appliance parent folder path (sVmParentPath) that the daemon uses, unsanitized, to build a single command string of the form tar -xf "%1" -C "%2". This string is handed to Qt's QProcess::splitCommand, which tokenizes it by whitespace and quote characters rather than passing an argv array directly to exec(). Because the folder path is attacker-controlled, embedding a double-quote character in it (e.g. a folder literally named /tmp/sprl_p_<uid>" --use-compress-program=/tmp/u<uid> ") closes the quoted -C argument early and reintroduces the remaining text as additional, attacker-chosen tar flags. macOS tar's --use-compress-program= flag is designed to let a user specify a custom (de)compression helper program; because the daemon subsequently invokes tar as root to "extract" the (nonexistent or empty) appliance, tar executes the attacker-named helper program at /tmp/u<uid> with root privileges, giving the unprivileged local user full code execution as uid 0. No running virtual machine is required to trigger the flaw -- only a vulnerable Parallels Desktop install, the dispatcher socket present, and any local unprivileged account.

JFrog assesses the risk as greatest on developer workstations, where malicious or poisoned Homebrew formulas or npm packages could already grant low-privileged local code execution that this bug then escalates to root, and on shared/multi-user Mac lab or institutional machines where several local accounts coexist. From root, an attacker can replace system software/binaries, read or modify any other local user's data, and establish persistence (e.g., via a root-owned launchd LaunchDaemon).

Alludo (Parallels' parent company) fixed the issue in Parallels Desktop 27.0.0 by changing the appliance-extraction code path to build tar's argument list as a fixed argv array instead of a single shell-like string, so a quote character in the folder name can no longer be reinterpreted as an argument delimiter. JFrog publicly disclosed technical details of CVE-2026-90894 (nicknamed "ParaShells") on 14 September 2026 while withholding release of the working exploit code itself.

## MITRE ATT&CK

- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543 Create or Modify System Process
- T1543.004 Create or Modify System Process: Launch Daemon
- T1554 Compromise Host Software Binary
- T1005 Data from Local System
- T1559 Inter-Process Communication
- T1548 Abuse Elevation Control Mechanism
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument Injection (CVE-2026-90894)](https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/)
- [Parallels Desktop CVE-2026-90894 (ParaShells) Vulnerability](https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/)
- [NVD - CVE-2026-90894](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-90894)
- [CVE-2026-90894 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-90894)
- [Parallels Desktop 27 Release Notes / Knowledge Base 131168](https://kb.parallels.com/en/131168)
- [Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root](https://cybersecuritynews.com/parallels-desktop-vulnerability/)
- [CVE-2026-90894: Parallels Desktop for Mac OS Command Injection](https://www.strix.ai/cve/CVE-2026-90894)
- [OffSeq Threat Radar - CVE-2026-90894 (CWE-88 Argument Injection)](https://radar.offseq.com/threat/cve-2026-90894-cwe-88-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-10f1d1d1dd01d6da)
- [Related prior vulnerability class: CVE-2024-34331 Parallels Desktop createinstallmedia signature-verification bypass LPE (same privileged-helper-tooling risk pattern)](https://jhftss.github.io/Parallels-0-day/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2536