PT-2026-7170 · Unity · Unity-Cli

Stephen Hodgson · Published 2026-02-09 · Updated 2026-02-28 · CVE-2026-25918

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions unity-cli versions prior to 1.8.2

Description The sign-package command in unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments, including --email and --password, are output via JSON.stringify without sanitization, potentially exposing secrets to shell history, CI/CD logs, and log aggregation systems. The vulnerable parameters are email and password.

Recommendations Update to version 1.8.2 or later.

Exploit

Fix

CSRF

Insertion into Log File

Weakness Enumeration

CWE-352

CWE-532

Related Identifiers

CVE-2026-25918

GHSA-4255-C27H-62M5

Affected Products

Unity-Cli

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25918.json · Exploit
• https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5 · Vendor Advisory
• https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25918 · Security Note
• https://ubuntu.com/security/CVE-2026-25918 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25918 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4255-c27h-62m5 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25918 · Security Note
• https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2 · Note
• https://github.com/RageAgainstThePixel/unity-cli · Note
• https://t.me/CVEtracker/44236 · Telegram Post
• https://t.me/cveNotify/153609 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021104209978912945 · Twitter Post
• https://twitter.com/CVEnew/status/2020982058076549496 · Twitter Post