Executive brief
The @rage-against-the-pixel/unity-cli command-line tool logs sensitive Unity account credentials in plaintext to debug output when the --verbose flag is used with the sign-package command. An attacker or insider with access to shell history, CI/CD logs, or log aggregation systems can extract plaintext passwords and email addresses, potentially leading to unauthorized account access and package tampering. The vulnerability affects all versions prior to 1.8.2 and requires explicit user action (enabling --verbose) but poses significant risk in automated and shared development environments.
Technical details
The sign-package command in @rage-against-the-pixel/unity-cli contains an insecure logging vulnerability (CWE-532: Insertion of Sensitive Information into Log File) where command-line arguments including --email and --password are passed directly to JSON.stringify() without sanitization when the --verbose debugging flag is enabled. This outputs credentials in plaintext to console output and log files. The vulnerability requires the attacker to either (1) have local access to shell history or log files where the command was executed, or (2) have visibility into CI/CD pipeline logs or centralized log aggregation systems. An exploited credential can grant unauthorized access to the attacker's Unity account and allow tampering with signed packages. The vulnerability has been patched in version 1.8.2 by implementing proper masking of sensitive strings in verbose output. Workarounds include using environment variables (UNITY_USERNAME, UNITY_PASSWORD) instead of command-line arguments and avoiding the --verbose flag when credentials are in use.
Affected products
- RageAgainstThePixel unity-cli < 1.8.2
Timeline
- 2026-02-10: disclosed: Advisory published on GitHub Security Advisory
- 2026-02-08: patched: Fix released in version 1.8.2
References
- https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5
- https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342
- https://github.com/RageAgainstThePixel/unity-cli
- https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2