Patch Parallels Desktop or accept that any logged-in user on the Mac can become root. JFrog researchers have now published the full chain behind ParaShells, a flaw the vendor fixed in version 27.0.0.
What has to line up
Three conditions do it. A vulnerable build of the virtualisation software must be installed, though no virtual machine has to be running. The prl_disp_service daemon — started automatically by its launch daemon and running as root — must be active with its socket present. And the attacker needs code execution as any low-privileged local user.
Yuval Moravchick, who leads JFrog’s vulnerability research team, described it as a world-writable Unix socket combined with weak local-client authentication and argument injection in the appliance extraction path.
The mechanics are unforgiving. That socket accepts a login trusting peer credentials instead of a Team ID, and an unpack routine assembles tar arguments through Qt string splitting. Drop a quote into the parent path and a compression flag gets injected, after which macOS tar executes the attacker’s script as uid 0.
Root on a Mac is no small prize. An intruder can swap out system software, read other users’ files, and survive reboots through launchd.
Alludo, which makes Parallels, shipped the fix at the start of September; the researcher reported CVE-2026-90894, confirmed against Parallels Desktop for Mac v26.4.0 on Apple silicon, with older builds left untested.
Exposure concentrates in two places — developer laptops, where one poisoned Homebrew formula or npm preinstall script opens the door, and shared university or corporate machines carrying many local accounts.
The practical response is an inventory of every Mac running Parallels Desktop, tighter controls on local accounts, and an upgrade to 27.0.0 or later.
