ParaShells Local Privilege Escalation in Parallels Desktop

JFrog researchers discovered a high-severity local privilege escalation (LPE) vulnerability, dubbed 'ParaShells' (CVE-2026-90894), affecting Parallels Desktop for Mac. The flaw resides in the root-level background service, `prl_disp_service`, which exposes a world-writable Unix socket and lacks sufficient authentication for local clients.

By leveraging the `PrlSrv_InstallAppliance` function, an attacker can perform an argument injection attack against the `tar` extraction process. Specifically, a malformed directory path containing double quotes allows the attacker to inject the `--use-compress-program` flag, leading to arbitrary code execution as root. While a fix is available in version 27.0.0, this version currently requires Apple silicon (M-series) Macs, leaving Intel-based Macs on the 26.x line potentially exposed without a verified patch.