CVE-2026-25918 unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
Attackers can read plaintext credentials from debug logs when the verbose flag is used in the Unity CLI sign-package command.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25918?
CVE-2026-25918 is a medium-severity vulnerability in RageAgainstThePixel unity-cli, published on 9 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.
Weakness: CWE-532
Which versions are affected by CVE-2026-25918?
2 open source packages ship an affected version, including @rage-against-the-pixel/unity-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@rage-against-the-pixel/unity-cli npm | All versions | 1.8.2 |
@rage-against-the-pixel/unity-cli npm | All versions | 1.8.2 |
Products include Rageagainstthepixel Unity-Cli.
How do I fix CVE-2026-25918?
Upgrade @rage-against-the-pixel/unity-cli to 1.8.2 or later.
Is CVE-2026-25918 being exploited?
There is no known exploitation of CVE-2026-25918 in the wild and no public exploit code.
Sources
Also known as GHSA-4255-c27h-62m5, UBUNTU-CVE-2026-25918.