PT-2026-7170 · Unity · Unity-Cli

Stephen Hodgson · Publicado 2026-02-09 · Atualizado 2026-02-28 · CVE-2026-25918

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Média

Vetor base

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions unity-cli versions prior to 1.8.2

Description The sign-package command in unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments, including --email and --password, are output via JSON.stringify without sanitization, potentially exposing secrets to shell history, CI/CD logs, and log aggregation systems. The vulnerable parameters are email and password.

Recommendations Update to version 1.8.2 or later.

Exploit

Correção

CSRF

Insertion into Log File

Enumeração de Fraquezas

CWE-352

CWE-532

Identificadores relacionados

CVE-2026-25918

GHSA-4255-C27H-62M5

Produtos afetados

Unity-Cli

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25918.json · Exploit
• https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2 · Nota
• https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5 · Aviso do Fabricante
• https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342 · Correção
• https://github.com/RageAgainstThePixel/unity-cli · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25918 · Aviso do Fabricante
• https://t.me/CVEtracker/44236 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25918 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-25918 · Aviso do Fabricante
• https://t.me/cveNotify/153609 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-25918 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2021104209978912945 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4255-c27h-62m5 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-25918 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020982058076549496 · Publicação no Twitter