Parallels puts the ParaShells root fix behind an Apple silicon requirement

On the Mac JFrog tested, the dispatcher socket was world-writable, so any program on the box could connect to it ^[6]. The login call that follows, PrlSrv_LoginLocal, checks only the credentials the kernel reports for the connecting process, requires no Parallels code signature, and accepts an account that is not an administrator ^[7]. To install a virtual machine appliance, the service assembles its unpack command as a single line of text, tar -xf "%1" -C "%2", then splits it back into arguments with Qt's QProcess::splitCommand ^[8]. The caller supplies part of that text, because it chooses the destination folder ^[9].

A double quote inside the folder name closes the quoting early, and whatever follows it arrives as extra tar options ^[9]. The option JFrog used, --use-compress-program, tells macOS tar to hand the archive to another program first ^[10]. tar is running as root here, so that program does too ^[10]. JFrog's test script wrote a passwordless sudo rule and opened a root shell ^[11].

Everything the attack needs is in a default install: the product present, the dispatcher service running with its socket, and one low-privileged local account ^[13]. No virtual machine has to be running ^[13]. The bug is on the Mac side of the product, so the host is the target and not the guests ^[5].

JFrog did not test back through the product's history. "We did not regression-test every older build for this writeup," the company said, telling readers instead to "Treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope." ^[14][15] It also said the App Store edition may start its services differently while carrying the same kind of problem ^[16].

Which build fixes it depends on the record you read. JFrog's advisory lists everything below 27.0.0 as affected, its writeup names 27.0.0 as fixed, and the CVE record lists 27.0.0 as unaffected ^[19]. The company's disclosure timeline dates the fix to 1 September 2026, while Parallels' release notes put 27.0.0 on 25 August 2026 and 27.0.1 on 1 September 2026, seven days later ^[20][26]. Installing 27.0.1, build 58670, satisfies both dates ^[21]. Parallels has not published anything on CVE-2026-90894 and says it does not discuss vulnerabilities until a fix is public; its list mapping flaws to fixed versions has not been reviewed since May 2025 ^[22][23].

Version 27 requires an Apple silicon processor and macOS Sonoma 14.7 or newer, and on earlier macOS, including Ventura 13, the installer puts down an older version instead ^[24]. Parallels removed Intel support in 27 ^[25]. For an Intel Mac, that leaves no patched build on the published record ^[27]. The preconditions are the installed product and the running dispatcher, so uninstalling Parallels Desktop ends the exposure on that hardware ^[28]. The other route is an Apple silicon Mac per seat.

The flaw does not cross the network, so it is the second half of a chain ^[3]. JFrog names the openings it expects to come first: a malicious Homebrew formula, a poisoned npm install script, a compromised build job, or one weak account on a shared lab or training Mac ^[18]. It reports no attacks using CVE-2026-90894 ^[17].