ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell
Blog post from JFrog
ParaShells, tracked as CVE-2026-90894, is a local privilege-escalation vulnerability in Parallels Desktop for Mac that reportedly allowed a non-administrative local process to execute code as root through the privileged prl_disp_service daemon. The issue combined a world-writable Unix socket, local authentication based on peer credentials rather than Parallels code-signing identity, and argument injection in the appliance installation extraction workflow, where a crafted destination path could inject macOS tar’s `--use-compress-program` option and launch an attacker-controlled script with root privileges. The demonstrated attack required Parallels Desktop to be installed and its dispatcher socket to be available, but did not require a running virtual machine, administrator access, or a signed Parallels client; it was confirmed on Parallels Desktop 26.4.0 build 57513 on Apple silicon. Potential consequences include full system compromise, persistence, access to other users’ data, and modification of system software, while recommended mitigations include inventorying affected Macs, restricting local account access, and upgrading to Parallels Desktop 27.0.0, which was released as the fix.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.