| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| datahihi1/tiny-env | ≥ 1.0.9, < 1.0.11< 1.0.3 | 1.0.111.0.3 |
| tinyenv | ≥ 1.0.1, < 1.0.3≥ 1.0.9, < 1.0.11 | 1.0.31.0.11 |
TinyEnv did not require the .env file to exist when loading environment variables.
This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.
Affected versions:
The issue has been fixed in version 1.0.11.
All users should upgrade to 1.0.11 or later.
As a workaround, users can manually verify the existence of the .env file before initializing TinyEnv, for example:
if (!file_exists(__DIR__ . '/.env')) {
throw new RuntimeException('.env file is missing!');
}
これらの製品をお使いですか?サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン