unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.
Users who run sign-package with --verbose and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using --verbose) but creates significant risk in automated and shared environments.
Workaround: Use environment variables (UNITY_USERNAME, UNITY_PASSWORD) instead of command-line arguments, and avoid the --verbose flag when working with credentials.
Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @rage-against-the-pixel/unity-cli | < 1.8.2 | 1.8.2 |
References
- https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5
- https://nvd.nist.gov/vuln/detail/CVE-2026-25918
- https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342
- https://github.com/RageAgainstThePixel/unity-cli
- https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-352, CWE-532- Platform
- npm
- Package
@rage-against-the-pixel/unity-cli- Disclosed
- 10.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4255-c27h-62m5 - CC BY 4.0
Vulnerability history: @rage-against-the-pixel/unity-cli
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.