Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90894— Parallels Desktop local privilege escalation via appliance extract argument injection

Quick assessment

Affected
Parallels Parallels Desktop for Mac
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Parallels Desktop 以 root 用户身份运行 。本地客户端通过全局可写的套接字 与之通信。 接口接受来自对等方的认证信息，且未进行 Parallels 签名验证，也不要求用户属于管理员组。 登录成功后，调用 接口时，攻击者可以指定设备文件夹路径（sVmParentPath）。守护进程使用一个单一字符串执行解包操作： ，随后通过 Qt 的 将该字符串拆分为单词。如果文件夹名称中包含引号，会导致引号提前闭合，使得剩余文本被解析为额外的 tar 参数。在 macOS 上， 的 选项会以前述方式以 roo

CVSS 7.8 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
Parallels Parallels Desktop for Mac 26.4.0 affected
27.0.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90894

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Parallels Desktop local privilege escalation via appliance extract argument injection
Source: CVE Program / CVE List V5
Vulnerability Description
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Parallels Parallels Desktop for Mac 26.4.0 -

II. Public POCs for CVE-2026-90894

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90894

请登录查看更多情报信息。

Vendor Pages for CVE-2026-90894 (2)

IV. Related Vulnerabilities

Same product: Parallels Desktop for Mac
Same vendor: Parallels
Same weakness: CWE-88

V. Comments for CVE-2026-90894

No comments yet

Leave a comment