CVE-2026-65636

YAML injection via unescaped newlines in ymlr document comments

Published Jul 31, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.

An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected.

This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2.

This issue affects ymlr from 0.0.1 before 5.1.6.

Analysis

Technical impact

An attacker who controls the text supplied as a comment can inject arbitrary YAML content. Because unescaped carriage return or line feed characters terminate the comment, the injected data is emitted at column zero and parsed as part of the document body. This allows forging of top‑level mapping keys, overriding of application‑supplied values, and the injection of---or ... document separators to create multiple YAML documents. The vulnerability originates from an improper neutralization of CRLF sequences and is classified as CWE‑93. The impact is a potential compromise of integrity and availability of any downstream consumer that interprets the generated YAML, such as configuration loaders, deployment manifests, CI pipelines, and data importers.

Affected Systems

The affected software is ufirstgroup ymlr. Versions from 0.0.1 up to but not including 5.1.6 are vulnerable. Any application using an affected version of this library is at risk.

Risk and Exploitability

The CVSS score for this vulnerability is 2.1, and the EPSS score is less than 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply untrusted text that is passed into a comment field by the application. If the application is exposed to attacker‑controlled input, the attacker can inject arbitrary YAML and potentially alter configuration or introduce malicious documents. The overall risk is low, but the deception of injecting new documents or overriding critical values can have significant downstream consequences.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ufirstgroup

ymlr

unaffected

Version	Status	Constraints
`0.0.1`	affected	< 5.1.6

ufirstgroup

ymlr

unaffected

Version	Status	Constraints
`0c11a86de83825e91c27cecaccb03f36416d8fe0`	affected	< 42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc

No data.

Vendor Product Versions

Ufirstgroup

Ymlr

Version	Status	Scheme	Platform
`[0.0.1,5.1.6)`	affected	semver	—

Ufirstgroup

Ymlr

Version	Status	Scheme	Platform
`[0c11a86de83825e91c27cecaccb03f36416d8fe0,42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc)`	affected	code_commit	—

Remediation

Vendor Workaround

Split any untrusted comment string on line breaks and pass the resulting list as the comment element of the {comment, data} tuple. Ymlr prefixes every list element with its own # marker, so no line can leave the comment context. Alternatively, reject comment strings that contain carriage return or line feed characters, or keep untrusted text out of comments entirely and place it in the encoded data instead, where the encoder quotes it.

OpenCVE Recommended Actions

Upgrade ufirstgroup ymlr to version 5.1.6 or later
Split any untrusted comment string on line breaks and pass the resulting list to the comment element of the {comment, data} tuple, so each line is prefixed with its own # marker
Alternatively, reject comment strings that contain carriage return or line feed characters, or keep untrusted text out of comments entirely and place it in the encoded data, ensuring the encoder quotes it

Generated by OpenCVE AI on August 3, 2026 at 09:55 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.197% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-65636.html
https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc
https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc
https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9
https://osv.dev/vulnerability/EEF-CVE-2026-65636

History

Jul 31, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 31, 2026 2:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected. This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr from 0.0.1 before 5.1.6.
Title		YAML injection via unescaped newlines in ymlr document comments
First Time appeared		Ufirstgroup Ufirstgroup ymlr
Weaknesses		CWE-93
CPEs		cpe:2.3:a:ufirstgroup:ymlr::::::::
Vendors & Products		Ufirstgroup Ufirstgroup ymlr
References		https://cna.erlef.org/cves/CVE-2026-65636.html https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9 https://osv.dev/vulnerability/EEF-CVE-2026-65636
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'}`