Parallels Desktop Vulnerability Allows Non-Admin Mac Users to Gain Root Access

A critical local privilege escalation vulnerability, identified as CVE-2026-90894 and nicknamed "ParaShells," has been discovered in Parallels Desktop for Mac. This flaw allows a standard, unprivileged user on a Mac to execute arbitrary code with root privileges, effectively granting them complete control over the system. The vulnerability was confirmed in Parallels Desktop version 26.4.0 build 57513, specifically on Apple Silicon Macs. Parallels has since addressed the issue by releasing version 27.0.0.

The exploit targets the prl_disp_service daemon, a privileged host process essential for Parallels Desktop's operations, including virtual machine management and network configuration. Because this service runs with root privileges, any compromise of its security can lead to a full system compromise. The "ParaShells" vulnerability is a result of a combination of three security weaknesses: a world-writable Unix socket, insufficient authentication for local clients, and argument injection during the appliance extraction process.

On a default installation, prl_disp_service listens on /var/run/prl_disp_service.socket. Researchers discovered that this socket could possess permissions allowing any local process to connect. Furthermore, the PrlSrv_LoginLocal function reportedly relies on operating system peer credentials for authentication rather than verifying the Parallels signature of the client. This allows an unsigned client, even one running under a standard user account, to authenticate successfully.

Once authenticated, an attacker can trigger the PrlSrv_InstallAppliance operation. This function is designed to extract virtual machine packages, but it can be manipulated. By providing a malicious path for the virtual machine's parent directory, an attacker can influence the tar extraction command executed by the service. The vulnerability lies in how the service constructs this command, using Qt's QProcess::splitCommand function, which can be tricked by specific path inputs.

Specifically, an attacker can inject a quotation mark into the parent path. This prematurely terminates the expected quoted argument for the tar extraction path, allowing the attacker to append an additional tar option. The injected option, --use-compress-program, instructs the macOS tar utility to launch an external program during the archive processing. Since prl_disp_service initiates this tar command as root, the attacker-controlled program is also executed with root privileges. This is a form of argument injection, not a traditional shell command injection, as the attacker directly manipulates the arguments passed to the tar command.

Crucially, a running virtual machine is not required to exploit this vulnerability. The demonstrated exploit chain only needs Parallels Desktop installed, the prl_disp_service running, and access to a low-privileged local account. A proof-of-concept exploit has shown that a single command can grant a root shell.

Potential attack vectors include malicious software already present on the system, compromised continuous integration pipelines, vulnerable npm installation scripts, poisoned Homebrew formulas, or any other code executing with standard user privileges. Successful exploitation could lead to unauthorized access to sensitive files, modification of system software, installation of persistent malware via launch daemons, alteration of sudo configurations, and complete control over the affected Mac.

Administrators are urged to identify all systems running Parallels Desktop and upgrade immediately to version 27.0.0 or later. Until patches can be applied, organizations should restrict access for local accounts and implement monitoring for systems exposing the dispatcher socket. Users can verify their Parallels Desktop version through the application's About window. Systems running build 57513 with a world-writable prl_disp_service.socket should be considered compromised until remediation is confirmed.