Ymlr
Monthly
CRLF injection in ufirstgroup's ymlr Elixir YAML library (versions 0.0.1 through < 5.1.6) allows an attacker who controls comment strings passed to any Ymlr document function to inject arbitrary content into the generated YAML output by embedding newline characters. Because ymlr emits each comment as '# {string}\n' without inspecting the string for embedded line breaks, anything after the first newline exits comment context and is written as raw YAML body content, enabling forged mapping keys, value overrides, and document-boundary markers. Every document-encoding entry point - document!/2, document/2, documents!/2, and documents/2 - shares the same vulnerable code path. No confirmed active exploitation or public exploit code exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the constrained preconditions required.
CRLF injection in ufirstgroup's ymlr Elixir YAML library (versions 0.0.1 through < 5.1.6) allows an attacker who controls comment strings passed to any Ymlr document function to inject arbitrary content into the generated YAML output by embedding newline characters. Because ymlr emits each comment as '# {string}\n' without inspecting the string for embedded line breaks, anything after the first newline exits comment context and is written as raw YAML body content, enabling forged mapping keys, value overrides, and document-boundary markers. Every document-encoding entry point - document!/2, document/2, documents!/2, and documents/2 - shares the same vulnerable code path. No confirmed active exploitation or public exploit code exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the constrained preconditions required.