PT-2026-66757 · Pypi · Ymlr
CVSS v4.0
2.1
Low
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
ufirstgroup ymlr versions 0.0.1 through 5.1.5
Description
Improper neutralization of CRLF (Carriage Return Line Feed) sequences in the
Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents via document comments. The functions document!/2, document/2, documents!/2, and documents/2 interpolate caller-supplied comment strings behind a # prefix without validating or escaping line breaks. Since YAML comments are terminated by line breaks, a carriage return or line feed ends the comment context, causing subsequent text to be treated as part of the document body. This enables attackers to forge top-level mapping keys, override application-set values, or use markers to split output into multiple documents, which are then parsed as legitimate data by downstream consumers like configuration loaders and CI pipelines. The issue is located in the lib/ymlr.ex file and specifically affects the document!/2 and documents!/2 routines.Recommendations
Update to version 5.1.6.
As a temporary workaround, split untrusted comment strings on line breaks and pass the resulting list as the comment element of the
{comment, data} tuple.
Reject comment strings containing carriage return or line feed characters.
Avoid placing untrusted text in comments and instead place it in the encoded data where the encoder applies quoting.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ymlr