Author: DigitalSpying Security Desk
Date: September 16, 2026
Executive Summary
In a notable security disclosure impacting macOS enterprise endpoints and developer workstations, cybersecurity researchers at JFrog Security Research have unmasked a local privilege escalation (LPE) vulnerability in Parallels Desktop for Mac. As reported by The Hacker News and Help Net Security, the vulnerability is tracked as CVE-2026-90894, dubbed "ParaShells" by JFrog vulnerability research lead Yuval Moravchick, and assigned a CVSS score of 7.8.
The flaw enables any low-privileged, standard user account or sandboxed process on macOS to achieve complete, unprompted root execution (uid 0) without requiring administrator rights or knowledge of the system password. By chaining an insecure world-writable Unix domain socket, lax peer-credential authorization, and command-line argument injection in Parallels' virtual appliance unpacking routine, an attacker can coerce the root-privileged prl_disp_service daemon into executing arbitrary bash scripts via the native macOS tar utility. Crucially, while Parallels developer Alludo patched the flaw in Parallels Desktop 27.0.0, the release completely deprecates support for Intel-based Macs—leaving thousands of legacy enterprise x86_64 Apple machines without an official vendor fix.
Deep-Dive Technical Analysis
1. Parallels Desktop macOS Architecture & IPC Surface
Parallels Desktop is the dominant virtualization software on macOS, enabling developers, security engineers, and enterprise users to run Windows, Linux, and custom virtual appliances alongside macOS:
* The Core Privileged Daemon (prl_disp_service): Parallels relies on a persistent background service—prl_disp_service—which executes continuously with full root (uid 0) privileges. This service configures hypervisor network bridges, disk mount points, kernel extensions/hypervisor frameworks, and virtual machine hardware states.
* Inter-Process Communication (IPC): To receive commands from GUI frontends and user processes, prl_disp_service listens on a local Unix domain socket: /var/run/prl_disp_service.socket
* World-Writable Permissions: Crucially, this socket is created with permissive permissions (0666 / world-writable), allowing any process running on the host—even an unprivileged guest or temporary user account—to initiate an IPC session.
2. The ParaShells Exploitation Chain
The exploit chains three distinct architectural flaws to bridge the gap from unprivileged user space to root:
1. Weak Local Client Authentication (PrlSrv_LoginLocal): When a local client connects to /var/run/prl_disp_service.socket, it initiates an authentication handshake via PrlSrv_LoginLocal. The daemon verifies peer credentials (PID/UID) provided by the operating system kernel, but fails to enforce cryptographic code-signing validation (such as checking that the connecting client belongs to Apple's or Parallels' approved Team ID). As long as the connecting process belongs to a valid local user, the privileged daemon accepts administrative IPC requests.
2. Appliance Installation & Unpack Routine: Parallels supports importing pre-configured virtual appliances (packaged as compressed archives). When an appliance installation request is triggered via IPC, the prl_disp_service daemon invokes an unpacking routine to extract the archive to a designated parent directory.
3. Qt String Splitting & Argument Injection:
* Rather than utilizing structured, parameterized system execution APIs (posix_spawn or execve with discrete argument vectors), the unpack routine constructs a command-line string for the macOS tar binary using Qt string concatenation and splitting logic.
* When constructing the extraction command, the daemon quotes path parameters naively.
4. Command Execution via --use-compress-program:
* An attacker creates a directory containing a double-quote character in its path name (e.g., /tmp/test"inject/).
* The unescaped quote prematurely terminates the directory argument string inside the tar command invocation.
* The attacker injects the command-line flag: --use-compress-program=/path/to/malicious_script.sh
* When prl_disp_service executes /usr/bin/tar with elevated privileges, tar invokes the attacker-specified compression wrapper script to decompress the archive.
* Because prl_disp_service runs as root, the script executes with uid 0, granting the attacker an unrestricted root shell.
+----------------------------------------------------------------------------------------------------+
| PARASHELLS (CVE-2026-90894) EXPLOIT CHAIN |
|---|
[Unprivileged Local Mac User (Standard Account / Low-Privilege Malware)]
|
| 1. Connects to World-Writable Unix Domain Socket:
| /var/run/prl_disp_service.socket
v
[prl_disp_service Daemon (Running with Root / uid 0 Privileges)]
|
| 2. Accepts IPC Connection via PrlSrv_LoginLocal
| Fails to Validate Apple Team ID / Code-Signing Certificates
v
[Virtual Appliance Import Trigger]
|
| 3. Attacker requests extraction into Crafted Directory Path with Quote:
| Path: /tmp/exploit" --use-compress-program=/tmp/payload.sh "
v
[Qt String Concatenation & Subprocess Construction]
|
| 4. Command string split breaks on quote -> Injects --use-compress-program flag
v
[Native macOS /usr/bin/tar Subprocess Spawn]
|
| 5. tar invokes attacker's payload.sh to handle compression stream
v
[Full macOS Host Takeover: Root Shell Acquired (uid 0)]
|
+---> Bypasses macOS Transparency, Consent, and Control (TCC) Privacy Controls
+---> Injects Kernel / Dylib Extensions & Extracts Keychain Secrets
+---> Disables Corporate Mobile Device Management (MDM) Profiles
+---> Establishes Persistent Backdoors across Host and Virtual Machine Boundaries
3. The "Intel Mac Dilemma": Why Enterprise Fleets Face High Risk
A critical dimension of this disclosure is the software update lifecycle:
* The Vendor Fix: Parallels developer Alludo remediated the argument injection defect in Parallels Desktop 27.0.0 by refactoring subprocess invocation to use safe array-based argument vectors and tightening IPC access controls.
* Architectural Abandonment: Parallels Desktop version 27 dropped support for Intel-based Macs, compiling exclusively for Apple Silicon (M1/M2/M3/M4) architectures.
* Unpatched Enterprise Legacy: Thousands of enterprise developers and IT departments continue to maintain Intel-based Macs (such as 2019/2020 MacBook Pros, Mac minis, and Mac Pros) to test x86 software. Because version 27 cannot be installed on x86 hardware, these machines remain indefinitely vulnerable unless manual defensive compensations are enforced.
Vulnerability Metrics
Parameter / Metric
Details
Vulnerability Identifier
CVE-2026-90894 ("ParaShells")
CVSS v3.1 Base Score
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
Local Privilege Escalation (LPE) / Argument Injection
Affected Daemon
prl_disp_service (Parallels Dispatcher Service)
Vulnerable Component
Appliance extraction path handling in /var/run/prl_disp_service.socket
Privileges Acquired
Full Host Root (uid 0)
Remediated Version
Parallels Desktop 27.0.0 (Apple Silicon Only)
Affected Versions
Parallels Desktop versions up to and including 26.4.0
Comprehensive Mitigation & Defense Playbook
1. Upgrade Apple Silicon Workstations to Parallels 27.0.0+
Organizations deploying Apple Silicon (M-series) Macs should immediately package and distribute Parallels Desktop version 27.0.0 or higher through enterprise Mobile Device Management (MDM) platforms (e.g., Jamf Pro, Kandji, Microsoft Intune):
* Verify installation with terminal command:prlsrvctl info --version
2. Mitigations for Legacy Intel (x86_64) Macs
Because Intel Macs cannot run Parallels 27, security engineers must deploy defensive controls to mitigate local abuse:
* Restrict Socket Permissions: While Parallels resets permissions on service restart, administrators can enforce restrictive access controls on the socket using a launch daemon script:chmod 660 /var/run/prl_disp_service.socket
chown root:admin /var/run/prl_disp_service.socket
(Note: Restricting socket access to the admin group prevents standard non-admin users from communicating with the dispatcher service).
* Endpoint Detection & Response (EDR) Behavioral Rules: Configure macOS EDR rules (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) to alert on:
* Any instance of /usr/bin/tar spawned by prl_disp_service where command-line arguments include --use-compress-program.
* Child processes spawned by tar executing interactive shells (/bin/sh, /bin/zsh, /bin/bash).
________________
Sources and Reference Intelligence: JFrog Vulnerability Research Blog, The Hacker News, Help Net Security, Tenable CVE Analysis.