medium5.1
CVE-2025-58759
TinyEnv: Inline comments not stripped properly in .env values
Impact
### Impact TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. ### Patches Fixed in v1.0.11. Users should upgrade to the latest patched version. ### Workarounds As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | datahihi1/tiny-env | >= 1.0.9, < 1.0.11 | 1.0.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Datahihi1 | Tinyenv | from 1.0.9 before 1.0.11 |