5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25918

CVE-2026-25918: unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25918

CVE-2026-25918:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@rage-against-the-pixel/unity-cli	npm	< 1.8.2	1.8.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-4255-c27h-62m5, involves the logging of plaintext credentials in @rage-against-the-pixel/unity-cli when using the --verbose flag. The root cause is the lack of sanitization before logging command-line options and arguments that may contain sensitive information.

Analysis of the patch commit 8d4d67b23d7c5fd8f00df3f0f10bec2961c95342 reveals two main locations where this vulnerability was addressed:

Command Action Handlers (src/cli.ts): Multiple commands defined in src/cli.ts (including the explicitly mentioned sign-package, activate-license, and others) were logging the entire options object as a JSON string in debug mode. This object contains parsed command-line arguments, including credentials like --email and --password. The vulnerable call was Logger.instance.debug(JSON.stringify(options)). The patch replaces this with a call to a new function, Logger.instance.debugOptions(options), which scrubs sensitive keys before logging. The vulnerable functions are the anonymous action handlers for these commands, as they were responsible for passing the unsanitized data to the logger.
Unity Editor Execution (src/unity-editor.ts): The UnityEditor.Run method, which is responsible for executing the Unity Editor with specific arguments, was logging the full command string. This could include sensitive arguments like -username and -password. The patch introduces a new method, scrubSensitiveArgs, to redact these values from the arguments array before the command string is constructed and logged.

Therefore, exploitation of this vulnerability would involve running one of the affected commands with credential arguments and the --verbose flag. A runtime profile would show execution within the anonymous action handler for the specific command in cli.ts, and potentially within UnityEditor.Run if the command triggers it, where sensitive data was being passed to logging functions prior to the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.