EUVD-2026-51537Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because specific app design flaw required; S:C because impact crosses into downstream YAML consumers distinct from the library itself.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single
prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.
An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected.
This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2.
This issue affects ymlr from 0.0.1 before 5.1.6.
AnalysisAI
CRLF injection in ufirstgroup's ymlr Elixir YAML library (versions 0.0.1 through < 5.1.6) allows an attacker who controls comment strings passed to any Ymlr document function to inject arbitrary content into the generated YAML output by embedding newline characters. Because ymlr emits each comment as '
{string}\n' without inspecting the string for embedded line breaks, anything after the first newline exits comment context and is written as raw YAML body content, enabling forged mapping keys, value overrides, and document-boundary markers. Every document-encoding entry point - document!/2, document/2, documents!/2, and documents/2 - shares the same vulnerable code path. No confirmed active exploitation or public exploit code exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the constrained preconditions required.
Technical ContextAI
ymlr (CPE: cpe:2.3:a:ufirstgroup:ymlr) is an Elixir library for encoding Elixir data structures as YAML documents. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers), which in this context applies to YAML comment construction: the pre-fix implementation in lib/ymlr.ex built comment lines via 'Enum.map_join(lines, "", &"
#{&1}\n")' - direct string interpolation with no content inspection. In YAML, a comment is terminated by the next newline character; an embedded '\n' or '\r' in a caller-supplied comment string therefore silently ends the comment and drops everything after it into the document body at column zero, where it is parsed as regular YAML data. The fix, delivered in commits 7e53061 and 42a0bf8, introduces a sanitize_comments/1 helper that splits each comment string on '\n' and re-emits each resulting fragment as its own '#'-prefixed line, neutralizing the injection without altering legitimate single-line comments.
RemediationAI
Upgrade ymlr to version 5.1.6 or later, which includes the sanitize_comments/1 fix landed in commits 7e53061fb2809b787fba0373c46b78e253c83adc and 42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc; see the vendor advisory at https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9 for guidance. As a compensating control prior to patching, applications should strip or replace all newline characters ('\n' and '\r') from any string before passing it as a comment argument to ymlr document functions - this fully neutralizes the injection but will silently truncate intended multi-line comment text, which may affect readability of generated YAML headers. Applications that do not expose the comment parameter to any untrusted input source are not at meaningful risk and may treat this as a routine dependency update.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today