{"id":"GHSA-72cm-7236-h43r","aliases":["CVE-2025-58759"],"title":"TinyEnv: Inline comments not stripped properly in .env values","description":"### Impact\nTinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.\n\n### Patches\nFixed in v1.0.11. Users should upgrade to the latest patched version.\n\n### Workarounds\nAs a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.","severity":"medium","score":5.1,"published":"2025-09-09T21:01:44.000Z","modified":"2025-09-10T21:56:17.423Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"datahihi1/tiny-env","ranges":[{"events":[{"introduced":"1.0.9"},{"fixed":"1.0.11"}],"type":"ECOSYSTEM"}],"versions":["1.0.10","1.0.9"],"fixed":["1.0.11"]}],"references":["https://github.com/datahihi1/tiny-env/security/advisories/GHSA-72cm-7236-h43r","https://nvd.nist.gov/vuln/detail/CVE-2025-58759","https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e","https://github.com/datahihi1/tiny-env"],"sources":[{"name":"OSV","id":"GHSA-72cm-7236-h43r","modified":"2025-09-10T21:56:17.423263Z","url":"https://osv.dev/vulnerability/GHSA-72cm-7236-h43r"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":5.1}]}