Parallels Desktop local privilege escalation via appliance extract argument injection
Summary
| CVE | CVE-2026-90894 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-14 10:17:06 UTC |
| Updated | 2026-09-14 11:17:07 UTC |
| Description | Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-78 | CWE-88 | CWE-269 | CWE-88 CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CWE-269 CWE-269 Improper Privilege Management
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Parallels | Parallels Desktop For Mac | affected 26.4.0 | macOS |
| CNA | Parallels | Parallels Desktop For Mac | unaffected 27.0.1 | macOS |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| kb.parallels.com/en/131168 | [email protected] | kb.parallels.com | |
| www.parallels.com/products/desktop | [email protected] | www.parallels.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yuval Moravchick | JFrog (en)
Additional Advisory Data
Solutions
CNA: Upgrade to Parallels Desktop 27.0.1 or later.
Exploits
CNA: JFrog has a private proof of concept that obtains root on Parallels Desktop 26.4.0. The same proof of concept does not obtain root on 27.0.1. Public exploit details are not included in this record.
There are currently no legacy QID mappings associated with this CVE.