CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.

• CWE-532

• https://github.com/RageAgainstThePixel/unity-cli/commit/8d4d67b23d7c5fd8f00df3f0f10bec2961c95342Patch
• https://github.com/RageAgainstThePixel/unity-cli/releases/tag/v1.8.2Release Notes
• https://github.com/RageAgainstThePixel/unity-cli/security/advisories/GHSA-4255-c27h-62m5Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25905The Python code being run by 'runPython' or 'runPythonAsync'…5.8
• CVE-2026-25906Dell Optimizer, versions prior to 6.3.1, contain an Improper…7.8
• CVE-2026-25907Dell PowerScale OneFS, version 9.13.0.0, contains an overly …7.5
• CVE-2026-25908Dell Alienware Command Center (AWCC), versions prior to 6.13…7.8
• CVE-2026-25916Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when …4.3
• CVE-2026-25917Dag Authors, who normally should not be able to execute code…7.2
• CVE-2026-2592The Zarinpal Gateway for WooCommerce plugin for WordPress is…7.7
• CVE-2026-25920SumatraPDF is a multi-format reader for Windows. In 3.5.2 an…5.5
• CVE-2026-25921Gogs is an open source self-hosted Git service. Prior to ver…9.3
• CVE-2026-25922authentik is an open-source identity provider. Prior to 2025…8.8
• CVE-2026-25923my little forum is a PHP and MySQL based internet forum that…9.1
• CVE-2026-25924Kanboard is project management software focused on Kanban me…8.4