CVE-2026-90894

🗓️ 14 Sep 2026 09:52:43Reported by JFROGType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 84 Views🌐 WEB

Parallels Desktop LPE via tar argument injection in PrlSrv_InstallAppliance grants root access.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-90894	16 Sep 202609:30	–	circl
Cvelist	CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection	14 Sep 202609:52	–	cvelist
EUVD	EUVD-2026-77346	14 Sep 202609:52	–	euvd
Tenable Nessus	Parallels Desktop < 27.0.0 Local Privilege Escalation (macOS)	18 Sep 202600:00	–	nessus
NVD	CVE-2026-90894	14 Sep 202610:17	–	nvd
Positive Technologies	PT-2026-91137	14 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-90894: Improper Neutralization of Argument Delimiters in a Command	14 Sep 202600:00	–	rapid7
The Hacker News	Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix	16 Sep 202613:14	–	thn
Vulnrichment	CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection	14 Sep 202609:52	–	vulnrichment

Vulners

Node

parallels parallels_desktopMatch26.4.0

[
  {
    "vendor": "Parallels",
    "product": "Parallels Desktop for Mac",
    "platforms": [
      "macOS"
    ],
    "packageName": "Parallels Desktop",
    "versions": [
      {
        "status": "affected",
        "version": "26.4.0"
      },
      {
        "status": "unaffected",
        "version": "27.0.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
kb	www.kb.parallels.com/en/131168
parallels	www.parallels.com/products/desktop/

Parameter	Position	Path	Description	CWE
sVmParentPath	path	/var/run/prl_disp_service.socket	A local client can interact with the prl_disp_service socket. The PrlSrv_InstallAppliance function allows an attacker to provide a path (sVmParentPath) containing a quote. Because the daemon uses QProcess::splitCommand to parse the path for a tar command, the quote can be used to inject additional tar flags, such as --use-compress-program, leading to arbitrary command execution as root.	CWE-269, CWE-78, CWE-88

18 Sep 2026 19:31Current

6Medium risk

Vulners AI Score6

CVSS 3.17.8

EPSS0.00168

SSVC

Parallels Desktop local privilege escalation argument injection tar command QProcess splitCommand PrlSrv_InstallAppliance