A Quote in a Folder Name Opens Root on Mac: The Parallels Bug

On September 14, 2026, JFrog Security Research published its analysis of CVE-2026-90894, a vulnerability in Parallels Desktop that allows any user-space process on macOS to obtain root privileges without meaningful authentication. The issue is not an isolated coding error but the combination of three insecure architectural choices: a root daemon exposing a world-writable socket, a login mechanism that trusts peer credentials without validating the Parallels Team ID, and a Qt parser that turns a quote in a directory name into executable flags for tar.

The Chain: Three Flaws That Chain Into Root

The analysis by JFrog researcher Yuval Moravchick identifies the technical core with lab-grade precision. The first link is prl_disp_service, the Parallels service dispatcher running as UID 0. The Unix socket it exposes is world-writable: permissions srwxrwxrwx make it reachable from any user process, regardless of privilege.

The second link is authentication. The PrlSrv_LoginLocal function uses macOS kernel peer credentials to identify the client but adds no check for a code signature bearing the Parallels Team ID, nor does it require membership in the admin group. An unsigned process launched by a standard user obtains a valid session.

The third link is the injection itself. When Parallels extracts an appliance — a compressed package used to distribute VM templates — the destination path sVmParentPath passes through Qt's QProcess::splitCommand. A quote in the directory name terminates the string early: the sequence /tmp/sprl_p_<uid>" --use-compress-program=/tmp/u<uid> " is split into separate arguments. The --use-compress-program flag tells macOS tar which program to use for decompression. Tar executes that program as UID 0.

The exploit is argument injection, not shell command injection: subtler, requiring no shell metacharacters, and passing through legitimate Qt APIs.

The PoC in the Lab: From Directory Name to /etc/sudoers.d

Moravchick verified the chain on Parallels Desktop 26.4.0 (build 57513) on macOS ARM64. The marker file written by the exploit reports UCP_UID=0, confirming execution as root. The injected script achieves write access to a file in /etc/sudoers.d/ with NOPASSWD ALL privileges for the attacking user.

No virtual machine needs to be running. The mere presence of an installed Parallels Desktop with prl_disp_service active exposes the attack surface. This significantly amplifies the delivery vector: npm preinstall scripts, compromised Homebrew formulae, or malware with limited user access can trigger the chain without victim interaction.

On version 27.0.0, released in early September 2026, the same input sequence produces a different result: tar is launched with a fixed argv list, the quote remains part of the directory name, and no arbitrary code executes as root.

Affected Versions and Patch Rollout

Version 26.4.0 is confirmed vulnerable in the lab. Version 26.4.2, released at an intermediate point, does not include the appliance-extraction fix: it remains vulnerable per the JFrog analysis. Only the jump to the 27.0.0 line blocks the vector.

The CVE-2026-90894 record rates impact on confidentiality, integrity, and availability all as HIGH, with a local attack vector (AV:L) requiring no user interaction (UI:N). Complexity is low (AC:L): once the chain is known, reproduction is straightforward.

The dossier does not specify whether versions prior to 26.4.0 are vulnerable: JFrog did not conduct a full regression test. It is also unconfirmed whether the App Store edition of Parallels Desktop shares the same socket behavior, a hypothesized difference in service startup.

"The chain is short: A world-writable Unix socket, a login that trusts peer credentials rather than a Team ID, and an appliance unpack path that builds tar arguments using Qt string splitting. A quote in the parent path injects --use-compress-program=, and macOS tar runs the attacker's script as uid 0 [i.e., root]." — Yuval Moravchick, JFrog vulnerability research team lead

What to Do Now

The primary source indicates specific actions and operational limits.

Update to Parallels Desktop 27.0.0. Version 27.0.0 blocks the exploit by launching tar with fixed arguments; versions 26.x, including 26.4.2, do not contain the fix.

Verify that prl_disp_service is not running on machines where Parallels is not needed. The socket /var/run/prl_disp_service.socket is present and active only with the service started.

Check for Parallels Desktop in local CI/CD build agents and shared developer workstations. These environments combine multiple users, dependency installation from scripts, and often delayed patching to avoid pipeline disruption.

No mitigation is available for the 26.x line: the dossier documents no workaround that blocks the vector without an update.

Why the IPC Architecture Is the Real Problem

The technical title of CVE-2026-90894 is "argument injection," but reading the case shifts the focus. The tar bug is the final link in a chain that begins with a design decision: entrusting a root daemon with a world-writable socket lacking standalone authentication.

Parallels Desktop is installed on millions of Macs, predominantly developer workstations, corporate environments, and shared university stations. In these contexts, the separation between standard users and root is often the only effective security boundary: macOS does not isolate user processes with the same rigidity as other operating systems. Escalation to root enables replacement of system software, access to other users' data, and persistence via launchd.

The choice of Qt's QProcess::splitCommand to build shell arguments from user-controlled paths is, in retrospect, a predictable attack surface. But it is predictable because the execution context — root, unsandboxed, with unvalidated input — amplifies every parsing error into total compromise.

Who Is Exposed and What We Don't Know

The highest risk falls on shared Macs and developer workstations with local CI/CD, where limited-privilege processes frequently install components from external sources. The absence of a running VM as a prerequisite lowers the exploitation threshold further.

No evidence of in-the-wild exploitation prior to the patch has emerged. The PoC developed by JFrog has not been published: the technical description is available, but not reproducible code. This reduces the risk of immediate replication but does not eliminate the possibility that actors with reverse-engineering capability could reconstruct the chain independently.

The number of Macs actually exposed is not quantified. The source does not provide version-by-version adoption data nor the distribution between the direct and App Store editions.

Frequently Asked Questions

Sources

• https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/
• https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html
• https://www.strix.ai/cve/CVE-2026-90894
• https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/
• https://www.cve.org/CVERecord?id=CVE-2026-90894
• https://en.wikipedia.org/wiki/Launchd
• https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/

Information verified against cited sources and current as of publication.

Sources