| Package | Affected versions | Patched versions |
|---|---|---|
| datahihi1/tiny-env | ≥ 1.0.9, < 1.0.11 | 1.0.11 |
| tinyenv | ≥ 1.0.9, < 1.0.11 | 1.0.11 |
TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.
Fixed in v1.0.11. Users should upgrade to the latest patched version.
As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free