An attacker who controls the text supplied as a comment can inject arbitrary YAML content. Because unescaped carriage return or line feed characters terminate the comment, the injected data is emitted at column zero and parsed as part of the document body. This allows forging of top‑level mapping keys, overriding of application‑supplied values, and the injection of---or ... document separators to create multiple YAML documents. The vulnerability originates from an improper neutralization of CRLF sequences and is classified as CWE‑93. The impact is a potential compromise of integrity and availability of any downstream consumer that interprets the generated YAML, such as configuration loaders, deployment manifests, CI pipelines, and data importers.

The affected software is ufirstgroup ymlr. Versions from 0.0.1 up to but not including 5.1.6 are vulnerable. Any application using an affected version of this library is at risk.

The CVSS score for this vulnerability is 2.1, and the EPSS score is less than 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply untrusted text that is passed into a comment field by the application. If the application is exposed to attacker‑controlled input, the attacker can inject arbitrary YAML and potentially alter configuration or introduce malicious documents. The overall risk is low, but the deception of injecting new documents or overriding critical values can have significant downstream consequences.