Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the unity-cli command line utility for the Unity Game Engine, specifically in versions prior to 1.8.2. When using the sign-package command with the --verbose flag, sensitive credentials such as email and password are logged in plaintext. These credentials are output via JSON.stringify without any sanitization, which means secrets can be exposed in shell history, CI/CD logs, and log aggregation systems.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive credentials including email addresses and passwords. Because these secrets are logged in plaintext, attackers or unauthorized users with access to shell history, CI/CD logs, or log aggregation systems could retrieve these credentials. This exposure increases the risk of unauthorized access, credential theft, and potential compromise of systems or accounts associated with those credentials.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the unity-cli utility to version 1.8.2 or later, where the issue is fixed.

Avoid using the --verbose flag with the sign-package command in versions prior to 1.8.2 to prevent sensitive credentials from being logged in plaintext.

Useful 0 Not Useful 0