TinyEnv: Inline comments not stripped properly in .env values

TRUNG BÌNH 6.5CVE-2025-58759 · GHSA-72cm-7236-h43r · Công bố 09/09/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-58759 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng datahihi1/tiny-env, tinyenv (datahihi1).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.21%, cao hơn 10.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
datahihi1/tiny-env Packagist	`≥ 1.0.9, < 1.0.11`	`1.0.11`
tinyenv datahihi1	`≥ 1.0.9, < 1.0.11`	`1.0.11`

Mô tả

Impact

TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.

Patches

Fixed in v1.0.11. Users should upgrade to the latest patched version.

Workarounds

As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

Mô tả của NVD

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. The issue is fixed in v1.0.11. Users should upgrade to the latest patched version. As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.