CVE-2026-25918
Credential Exposure via Verbose Logging in unity-cli sign-package Command
Publication date: 2026-02-09
Last updated on: 2026-02-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rageagainstthepixel | unity-cli | to 1.8.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
The vulnerability exists in the unity-cli command line utility for the Unity Game Engine, specifically in versions prior to 1.8.2. When using the sign-package command with the --verbose flag, sensitive credentials such as email and password are logged in plaintext. These credentials are output via JSON.stringify without any sanitization, which means secrets can be exposed in shell history, CI/CD logs, and log aggregation systems.
How can this vulnerability impact me? :
This vulnerability can lead to the exposure of sensitive credentials including email addresses and passwords. Because these secrets are logged in plaintext, attackers or unauthorized users with access to shell history, CI/CD logs, or log aggregation systems could retrieve these credentials. This exposure increases the risk of unauthorized access, credential theft, and potential compromise of systems or accounts associated with those credentials.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the unity-cli utility to version 1.8.2 or later, where the issue is fixed.
Avoid using the --verbose flag with the sign-package command in versions prior to 1.8.2 to prevent sensitive credentials from being logged in plaintext.