A newly documented security flaw in Parallels Desktop, identified as CVE-2026-90894 and nicknamed “ParaShells,” could let any local account on a Mac escalate to full root control of the host machine, according to researchers at JFrog.
The risk is greatest on developer machines, where something as ordinary as a compromised Homebrew formula or a malicious npm preinstall script could serve as the entry point for escalating from a standard user to complete system control.
Shared computers with multiple local accounts — think university labs or office workstations — face similar exposure, said Yuval Moravchick, who leads JFrog’s vulnerability research team.
Once an attacker reaches root, Moravchick said, they can swap out system software, access other users’ files, and maintain persistence through launchd.
Inside the ParaShells Exploit Chain
CVE-2026-90894 is an argument-injection bug confirmed to affect Parallels Desktop for Mac version 26.4.0 running on Apple silicon. Earlier releases haven’t been ruled out, but JFrog’s team didn’t test them.
Three conditions have to line up for ParaShells to work: the vulnerable version of Parallels needs to be installed, though no virtual machine actually has to be running; the prl_disp_service — which launches automatically as root via its daemon — must be active, along with its accompanying socket at /var/run/prl_disp_service.socket; and the attacker needs the ability to execute code under any low-privileged local account.
Moravchick described the mechanics as a combination of weaknesses stacking together: a Unix socket left world-writable, a client-authentication scheme that verifies peer credentials instead of checking a Team ID, and an argument-injection flaw in how the software unpacks appliance files.
“The chain is short,” he said. “A world-writable Unix socket, a login that trusts peer credentials rather than a Team ID, and an appliance unpack path that builds tar arguments using Qt string splitting.” A stray quote character in the parent path allows the attacker to inject the flag “–use-compress-program=”, causing macOS’s tar utility to execute the attacker’s script with root privileges.
Disclosure and Fix for CVE-2026-90894
JFrog reported the ParaShells vulnerability to Parallels’ parent company, Alludo, which patched the issue in Parallels Desktop version 27.0.0, released in early September 2026.
The company published its technical write-up two weeks after the patch shipped, but withheld the one-line proof-of-concept script it had developed to demonstrate the exploit.
Moravchick recommended that organizations identify every Mac running Parallels Desktop, restrict local account permissions on those systems, and update to version 27.0.0 or later to close off CVE-2026-90894.
