CVE-2026-90894 in Parallels
Summary
by MITRE • 09/14/2026
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.
After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified involves a critical privilege escalation flaw within Parallels Desktop, specifically affecting the prl_disp_service daemon which operates with root privileges on macOS systems. The service exposes its functionality through a world-writable Unix domain socket located at /var/run/prl_disp_service.socket, allowing any local user to establish communication with the privileged process without authentication barriers. While the PrlSrv_LoginLocal function does accept peer credentials from connecting clients, it fails to enforce sufficient access controls such as verifying membership in an administrative group or validating a cryptographic signature against Parallels' trusted keys. This lack of strict authorization means that any local user can successfully authenticate and interact with sensitive management functions exposed by the daemon.
The core technical flaw resides in the PrlSrv_InstallAppliance function, which allows users to specify a target directory for unpacking virtual appliance files via the sVmParentPath parameter. The implementation constructs a shell command using string concatenation rather than safe argument passing mechanisms. Specifically, it forms a command line that includes tar -xf followed by the user-supplied path and then executes this string through Qt's QProcess::splitCommand function. This splitting mechanism is vulnerable to injection because if the provided folder name contains quotation marks or other shell metacharacters, they can prematurely terminate the intended argument boundaries. For instance, a carefully crafted path ending with a quote character will close the filename argument early in the command string construction process.
This structural weakness enables an attacker to inject arbitrary flags into the tar execution context. By manipulating the input such that the closing quote of the folder name is followed by malicious parameters, these injected strings are interpreted as additional options for the tar utility rather than part of the file path or filename. In macOS environments, the tar command supports a --use-compress-program option which allows users to specify an external program to handle decompression. When this flag is present in the injected payload, it instructs tar to execute the specified program with the same privileges as the parent process. Since prl_disp_service runs as root, any program invoked through this mechanism will also be executed with root-level permissions.
The operational impact of this vulnerability is severe, resulting in arbitrary code execution with full system administrator rights on the affected host. An unprivileged local user can exploit this flaw to gain complete control over the macOS environment, bypassing standard security boundaries and sandbox restrictions inherent to virtualization software. This aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, where unsanitized input leads to unintended command execution. Furthermore, this attack vector maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging shell commands for privilege escalation and lateral movement within the local system context.
Mitigation strategies must address both the architectural design flaws and immediate configuration weaknesses. The most effective long-term solution involves modifying the prl_disp_service daemon to avoid using shell interpreters or string-based command construction when invoking external utilities like tar. Instead, developers should implement direct API calls that pass arguments as distinct array elements, thereby preventing any possibility of argument injection regardless of special characters in input data. Additionally, strict access control lists must be applied to the /var/run/prl_disp_service.socket file to restrict write permissions to only authorized administrative users or specific service accounts rather than leaving it world-writable. Implementing cryptographic signature verification for all incoming requests and enforcing group-based authorization checks within PrlSrv_LoginLocal would further harden the authentication layer against unauthorized access attempts by non-privileged entities.