GHSA-4255-c27h-62m5
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
Quick fix
GHSA-4255-c27h-62m5 — @rage-against-the-pixel/unity-cli: upgrade to the fixed version with the command below.
npm install @rage-against-the-pixel/unity-cli@1.8.2Details
The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the `--verbose` flag is used. Command-line arguments including `--email` and `--password` are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.
Users who run sign-package with `--verbose` and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using `--verbose`) but creates significant risk in automated and shared environments.
Workaround: Use environment variables (`UNITY_USERNAME`, `UNITY_PASSWORD`) instead of command-line arguments, and avoid the `--verbose` flag when working with credentials.
Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 1.8.2npm install @rage-against-the-pixel/unity-cli@1.8.2References
- https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-25918[ADVISORY]
- https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342[WEB]
- https://github.com/RageAgainstThePixel/unity-cli[PACKAGE]
- https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2[WEB]