What is GHSA-72cm-7236-h43r?

GHSA-72cm-7236-h43r is a security advisory published by GitHub Security Advisories with Medium severity. TinyEnv: Inline comments not stripped properly in .env values

Which CVE IDs does GHSA-72cm-7236-h43r cover?

GHSA-72cm-7236-h43r covers the following CVE IDs: CVE-2025-58759. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-72cm-7236-h43r?

GHSA-72cm-7236-h43r has a CVSS v3 base score of 5.1, published by GitHub Security Advisories.

Which products are affected by GHSA-72cm-7236-h43r?

GHSA-72cm-7236-h43r affects 1 product, including: composer/datahihi1/tiny-env:\u003e= 1.0.9, \u003c 1.0.11.

GHSA-72cm-7236-h43rMediumCVSS 5.1

TinyEnv: Inline comments not stripped properly in .env values

Vendor

GitHub Security Advisories

Published

September 9, 2025

Last Modified

September 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-58759 →

📋 Description

Impact

TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.

Patches

Fixed in v1.0.11. Users should upgrade to the latest patched version.

Workarounds

As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.

🎯 Affected products1

composer/datahihi1/tiny-env:>= 1.0.9, < 1.0.11

🔗 References (4)

https://github.com/datahihi1/tiny-env/security/advisories/GHSA-72cm-7236-h43r
https://github.com/datahihi1/tiny-env/commit/69b7b885e6cfbf07f470fb3512360e0caa95521e
https://nvd.nist.gov/vuln/detail/CVE-2025-58759
https://github.com/advisories/GHSA-72cm-7236-h43r