CVE-2026-90894 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-90894

CVSS 7.8 · High EPSS 0,17%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Skor CVSS 3.1 7.8 (High) menurut jfrog.com.

Deskripsi (NVD)

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

Rincian

Terbit di NVD: 14 September 2026
Terakhir diubah: 18 September 2026
Status NVD: Awaiting Analysis
CVSS 3.1: 7.8 (High), sumber jfrog.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-269: Improper Privilege Management
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 5,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.