CVE-2026-25918: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25918 is a plaintext credential exposure vulnerability in @rage-against-the-pixel/unity-cli, a command-line utility for the Unity Game Engine. When the --verbose flag is used with the sign-package command, sensitive credentials including --email and --password arguments are logged in plaintext via JSON.stringify without sanitization. All versions prior to 1.8.2 are affected. The vulnerability was published by the maintainer (StephenHodgson) on February 8, 2026, and assigned CVE-2026-25918 on February 9, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). In affected versions, the sign-package command (and other commands) called Logger.instance.debug(JSON.stringify(options)) directly, serializing the entire options object — including --email, --password, --serial, and --token fields — without any scrubbing. This occurs only when the --verbose flag is explicitly passed, but in CI/CD pipelines this flag is commonly enabled for diagnostic purposes. The fix in v1.8.2 introduces a debugOptions() method that deep-clones the options object and replaces sensitive keys with [REDACTED] before logging, and adds a maskCredential() method to mask values in CI environments (GitHub Commit, GitHub Advisory).

Successful exploitation results in high confidentiality impact: Unity account credentials (email and password) are exposed in plaintext in shell history, CI/CD pipeline logs, and log aggregation systems accessible to anyone with read access to those artifacts. There is no integrity or availability impact. In shared or automated environments, exposed credentials could enable unauthorized access to Unity accounts, potentially allowing an attacker to compromise Unity project signing, asset store accounts, or associated services (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported (Feedly). The vulnerability requires a local attack vector and the precondition that the --verbose flag is used alongside credential arguments, making it situational rather than broadly exploitable. The EPSS score is approximately 0.013% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target environment: Determine that a CI/CD pipeline or developer workstation uses @rage-against-the-pixel/unity-cli versions prior to 1.8.2 with the sign-package command invoked using the --verbose flag and explicit --email/--password arguments.
2. Gain access to logs: Obtain read access to CI/CD pipeline logs (e.g., GitHub Actions logs, Jenkins build logs), shell history files (e.g., ~/.bash_history, ~/.zsh_history), or log aggregation systems (e.g., Splunk, ELK) where the tool output is stored.
3. Extract credentials: Search the logs for JSON-serialized output containing email and password fields, which appear in plaintext as part of the JSON.stringify(options) debug output.
4. Use credentials: Authenticate to Unity services or associated accounts using the recovered email and password to perform unauthorized actions such as package signing, account takeover, or lateral movement to connected services (GitHub Advisory, GitHub Commit).

• Logs: CI/CD pipeline logs or shell output containing JSON-serialized objects with plaintext email and password fields from unity-cli debug output (e.g., {"email":"user@example.com","password":"plaintext_password",...}).
• Shell History: Entries in ~/.bash_history, ~/.zsh_history, or equivalent files showing unity-cli sign-package --verbose --email <email> --password <password> invocations.
• Log Aggregation: Queries in SIEM or log aggregation systems returning unity-cli debug output containing credential fields in plaintext.
• Unauthorized Access: Unexpected Unity account logins or package signing events from unfamiliar IP addresses or at unusual times, potentially indicating credential misuse following exposure (GitHub Advisory).

Upgrade @rage-against-the-pixel/unity-cli to version 1.8.2 or later, which properly masks sensitive strings when --verbose is enabled (v1.8.2 Release). As an immediate workaround, use environment variables (UNITY_USERNAME, UNITY_PASSWORD) instead of command-line arguments, and avoid the --verbose flag when credentials are involved — existing RageAgainstThePixel and Buildalon GitHub Actions are unaffected as they use environment variables exclusively (GitHub Advisory). After upgrading, review CI/CD logs and shell history for previously exposed credentials and rotate any compromised Unity account passwords. Restrict access to CI/CD logs and shell history to authorized personnel only.

The vulnerability was disclosed responsibly by the project maintainer StephenHodgson via a GitHub Security Advisory on February 8, 2026, with a patch released the same day (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the advisory has been identified. The fix was well-scoped, addressing not only the sign-package command but also applying credential scrubbing across all other commands in the CLI that used the same unsafe debug logging pattern (GitHub Commit).