unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.

Affected: npm: @rage-against-the-pixel/unity-cli

The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the `--verbose` flag is used. Command-line arguments including `--email` and `--password` are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.

Users who run sign-package with `--verbose` and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using `--verbose`) but creates significant risk in automated and shared environments.

Workaround: Use environment variables (`UNITY_USERNAME`, `UNITY_PASSWORD`) instead of command-line arguments, and avoid the `--verbose` flag when working with credentials.

Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.

Affected: Ubuntu:16.04:LTS: unity, Ubuntu:18.04:LTS: unity, Ubuntu:20.04:LTS: unity, Ubuntu:22.04:LTS: unity, Ubuntu:24.04:LTS: unity, Ubuntu:25.10: unity, Ubuntu:26.04:LTS: unity

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.