JFrog’s vulnerability research team disclosed a local privilege escalation flaw in Parallels Desktop for Mac that lets any ordinary user account on the machine gain full root — the highest level of system access on macOS. The researcher named it ParaShells and tracks it as CVE-2026-90894, with a CVSS score of 7.8.
The flaw lives in a background service called prl_disp_service that Parallels installs and runs as root to manage host networking and unpack virtual machine packages. On a standard install the service’s socket is world-writable, meaning any process on the Mac can connect to it, and the login call it exposes (PrlSrv_LoginLocal) asks only for the kernel-reported credentials of the connecting process — no Parallels code signature, no administrator check. When the service builds the command to install a virtual machine appliance, it assembles a tar -xf "%1" -C "%2" command string and re-parses it with Qt’s QProcess::splitCommand. Because the caller controls the destination folder path, a double-quote character in the folder name breaks out of the quoting context, and extra arguments follow — including --use-compress-program, which causes tar (running as root) to hand the archive to an attacker-chosen program. JFrog’s test script wrote a passwordless sudo rule and obtained a root shell. No virtual machine needs to be running; the attack requires only a standard Parallels Desktop install and any low-privileged account on the machine. JFrog noted that a malicious Homebrew formula, a poisoned npm install script, or a compromised build agent on a shared Mac would each provide exactly the level of initial access needed.
How to check if you’re affected
Affected versions are all Parallels Desktop installations older than 27.0.0 on Mac. Check your version under Parallels Desktop menu → About Parallels Desktop. If you are on an Apple silicon Mac, update to version 27 now through the in-app updater or from the Parallels website. Intel Mac users cannot install version 27 — Parallels no longer supports Intel hardware at that version — and must treat the flaw as unpatched until further guidance from Parallels. On a shared or lab Mac, restrict who can run Parallels sessions until a fix is available for Intel hardware.