unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.

N/A

通过日志文件的信息暴露

unity-cli 日志信息泄露漏洞

unity-cli是RageAgainstThePixel开源的一个Unity游戏引擎的命令行实用程序。 unity-cli 1.8.2之前版本存在日志信息泄露漏洞，该漏洞源于sign-package命令以明文记录敏感凭据，可能导致凭据泄露。

N/A

N/A