A serious local privilege escalation vulnerability has been discovered in Parallels Desktop for Mac that could allow non-administrator users or low-privileged processes to execute code with root access. The flaw, identified as CVE-2026-90894 and dubbed “ParaShells,” affects Apple Silicon Macs running Parallels Desktop version 26.4.0 build 57513. The issue is resolved in version 27.0.0 and newer.
How the Exploit Works
At the heart of the vulnerability lies prl_disp_service, a host daemon used by Parallels Desktop to handle privileged operations such as virtual machine management, network configuration, and appliance installation. Because this service runs as root, any unsafe communication to it opens up risk for complete system compromise.
The exploit chain combines three distinct weaknesses: a world-writable Unix socket, weak client authentication, and argument injection during appliance extraction. In a default install, the dispatcher service listens on /var/run/prl_disp_service.socket with file permissions of 0777, which allows any local process to connect. The authentication mechanism trusts OS peer credentials rather than verifying the client is signed by Parallels, meaning a standard user or unsigned process can authenticate successfully. Vulnerability arises when the PrlSrv_InstallAppliance action is invoked with a manipulated parent directory path. By inserting a quotation mark in this path, attackers can break out of the expected argument boundaries, inject a new tar option like --use-compress-program, and thus trigger code execution as root during archive extraction.
Scope, Risks, and Mitigation
The exploit does not require a running virtual machine but does depend on the presence of the vulnerable Parallels service and a low-privileged user account. Potential attack vectors include malicious installer packages, compromised continuous integration jobs, Homebrew formulas, or other scripts run by standard user accounts. If exploited successfully, attackers could access other users’ files, alter system software, install persistent root daemons, or modify sudo settings—a full system compromise.
To guard against this vulnerability, all users and organizations should immediately update any affected installation to Parallels Desktop 27.0.0 or later. In the meantime, it’s advised to restrict who can use local accounts, monitor for exposure of the dispatcher socket, and verify both version and socket permissions. Specifically, systems running build 57513 with a world-writable prl_disp_service.socket should be considered at high risk until corrected.
This vulnerability is part of a broader trend: virtualization software, especially tools with privileged helper services like Parallels, VMware, or QEMU, continue to be a prime target for privilege escalation attacks. As use of these tools grows—especially on Apple Silicon where fewer defenses are tested—rigorous security design and fast patching become non-negotiable.
