GHSA-72cm-7236-h43r
TinyEnv: Inline comments not stripped properly in .env values
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | datahihi1/tiny-env | >= 1.0.9, < 1.0.11 | 1.0.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.
### Patches
Fixed in v1.0.11. Users should upgrade to the latest patched version.
### Workarounds
As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
References
External links from the advisory. They lead to third-party sites.