Medium, CVSS 5.9npmAmendedPublished
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
CVE-2026-25918 · GHSA-4255-c27h-62m5
- Affected
- npm @rage-against-the-pixel/unity-cli < 1.8.2
- Fixed in
- 1.8.2· Vendor fix available
- Issue
- The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. Users who run sign-package with --verbose and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using --verbose) but creates significant risk in automated and shared environments. Workaround: Use environment variables (UNITYUSERNAME, UNITYPASSWORD) instead of command-line arguments, and avoid the --verbose flag when working with credentials. Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.