The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.
Users who run sign-package with --verbose and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using --verbose) but creates significant risk in automated and shared environments.
Workaround: Use environment variables (UNITY_USERNAME, UNITY_PASSWORD) instead of command-line arguments, and avoid the --verbose flag when working with credentials.
Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the
--verboseflag is used. Command-line arguments including--emailand--passwordare output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.Users who run sign-package with
--verboseand credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using--verbose) but creates significant risk in automated and shared environments.Workaround: Use environment variables (
UNITY_USERNAME,UNITY_PASSWORD) instead of command-line arguments, and avoid the--verboseflag when working with credentials.Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.