CVE-2026-65636
Received Received - Intake

CRLF Injection in ymlr Elixir Library

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: EEF

Description
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected. This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr from 0.0.1 before 5.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-65636
EUVD
EUVD-2026-51537

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ufirstgroup ymlr to 5.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of CRLF sequences in the Ymlr library for Elixir. Attackers can inject arbitrary content into YAML documents by manipulating comment strings. The library fails to validate or escape line breaks in comments, allowing attackers to forge keys, override values, or split documents. This affects multiple document encoding functions in the library.

Detection Guidance

This vulnerability affects the Elixir Ymlr library versions before 5.1.6. To detect it, check if your system uses ymlr by inspecting Elixir project dependencies or running mix deps in a project directory. Look for versions below 5.1.6. No specific commands are provided for detection beyond version checks.

Impact Analysis

If you use the affected Ymlr library versions, attackers could manipulate YAML output to inject malicious data. This could lead to misconfigured systems, incorrect application behavior, or unauthorized data exposure. Systems relying on YAML for configuration, deployment, or data processing are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized data modification or injection in YAML documents, potentially violating integrity and confidentiality requirements in GDPR and HIPAA. Attackers may forge keys or inject malicious content that downstream systems parse as valid data.

Mitigation Strategies

Immediately update the ymlr library to version 5.1.6 or later. If using Elixir projects, run mix deps.update ymlr or specify the updated version in mix.exs. Avoid passing untrusted input as comment strings to Ymlr.document!/2 or related functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart