ParaShells: tar argument injection via quoted path passed to InstallAppliance

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•2

Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.