Pypi · Ymlr · CVE-2026-65636
**Name of the Vulnerable Software and Affected Versions**
ufirstgroup ymlr versions 0.0.1 through 5.1.5
**Description**
Improper neutralization of CRLF (Carriage Return Line Feed) sequences in the `Elixir.Ymlr` module allows attackers to inject arbitrary content into generated YAML documents via document comments. The functions `document!/2`, `document/2`, `documents!/2`, and `documents/2` interpolate caller-supplied comment strings behind a # prefix without validating or escaping line breaks. Since YAML comments are terminated by line breaks, a carriage return or line feed ends the comment context, causing subsequent text to be treated as part of the document body. This enables attackers to forge top-level mapping keys, override application-set values, or use markers to split output into multiple documents, which are then parsed as legitimate data by downstream consumers like configuration loaders and CI pipelines. The issue is located in the `lib/ymlr.ex` file and specifically affects the `document!/2` and `documents!/2` routines.
**Recommendations**
Update to version 5.1.6.
As a temporary workaround, split untrusted comment strings on line breaks and pass the resulting list as the comment element of the `{comment, data}` tuple.
Reject comment strings containing carriage return or line feed characters.
Avoid placing untrusted text in comments and instead place it in the encoded data where the encoder applies quoting.