ufirstgroup ymlr up to 5.1.5 Ymlr module lib/ymlr.ex Elixir.Ymlr.document/Elixir.Ymlr.documents crlf injection

Summaryinfo

A vulnerability was found in ufirstgroup ymlr up to 5.1.5. It has been declared as critical. Affected is the function Elixir.Ymlr.document/Elixir.Ymlr.documents of the file lib/ymlr.ex of the component Ymlr module. Such manipulation leads to crlf injection. This vulnerability is documented as CVE-2026-65636. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ufirstgroup ymlr up to 5.1.5. Affected by this issue is the function Elixir.Ymlr.document/Elixir.Ymlr.documents of the file lib/ymlr.ex of the component Ymlr module. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected. This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr from 0.0.1 before 5.1.6.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-65636 since 07/22/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 5.1.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ufirstgroup

Name

• ymlr

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5

Website

• Product: https://github.com/ufirstgroup/ymlr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion