GitHub Advisoryadvisory · Packagist

GHSA-72cm-7236-h43r TinyEnv: Inline comments not stripped properly in .env values

MEDIUM Published 2025-09-09 Modified 2025-09-10 Official page ↗
Aliases
CVE-2025-58759
Ecosystem
Packagist
Packages
datahihi1/tiny-env
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-20
Reviewed
2025-09-09

Affected packages

• Packagist datahihi1/tiny-env: >= 1.0.9, < 1.0.11 → fixed in 1.0.11

Description

Impact TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. Patches Fixed in v1.0.11. Users should upgrade to the latest patched version. Workarounds As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

Related

Alias · CVE (1)

  • CVE-2025-58759 TinyEnv is an environment variable loader for PHP applications. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References