A stray quote tucked inside a folder name is all it takes for an ordinary account on a Mac to run code as root.
Security researchers at JFrog found that opening in Parallels Desktop, the software that lets Macs run Windows and Linux alongside macOS. They named the chain ParaShells, tracked as CVE-2026-90894 and rated 7.8 out of 10.
A daemon that already runs as root
The privileged piece is prl_disp_service, a background service the app installs to handle host networking and unpack virtual machine appliances. On the build JFrog tested, version 26.4.0 build 57513 on Apple silicon, the socket it listens on was world-writable, and its login call trusts only the credentials the kernel reports. No Parallels signature is required, and a non-administrator account passes.
The installer then assembles one text line, tar -xf “%1” -C “%2”, and hands it to Qt’s string splitter. A double quote in the destination folder closes the quoting early, so the rest becomes extra tar options. JFrog chose –use-compress-program, which tells macOS tar to run a script of its choosing first. Since tar runs as root, so does that script.
Where the repair stops
A normal installation supplies everything needed, and nothing travels over a network. JFrog lists Parallels Desktop 27.0.0 as the fixed release, and that version requires Apple silicon, so Intel Macs cannot install the repair. The vendor has published no statement, and its security fixes page has not been reviewed since May 2025. No attacks have been reported.
JFrog suggests checking whether the dispatcher socket is world-writable, trimming local accounts on shared machines, and upgrading to 27.0.0 or later.
