unity-cli is a command‑line tool that signs Unity packages. A bug in the sign‑package command causes verbose logs to contain plaintext credentials provided via --email and --password. These log entries are written without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. The resulting vulnerability permits disclosure of user credentials.

The affected vendor is RageAgainstThePixel, product unity‑cli. The vulnerability exists in all releases prior to 1.8.2. Version 1.8.2 and later contain the fix. Users running older versions that invoke sign‑package with the --verbose flag are affected.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the attacker to trigger the sign‑package command with verbose logging or to obtain access to the resulting log files. If a compromised CI/CD pipeline or local environment can run the command, credentials could be captured easily, leading to potential account compromise.