Executive brief
A vulnerability in the 'ymlr' Elixir library, which is used to generate YAML configuration files, allows attackers to inject malicious content into documents. By including line-break characters in what should be a simple comment, an attacker can trick the system into creating unauthorized configuration settings or splitting one document into many. This could lead to the corruption of deployment manifests, CI/CD pipelines, or other automated systems that rely on these generated files.
Technical details
The vulnerability exists in the Elixir.Ymlr module, specifically within the document/2, document!/2, documents/2, and documents!/2 functions. The library fails to properly neutralize or escape CRLF sequences (carriage returns and line feeds) in caller-supplied comment strings. Because YAML comments are terminated by line breaks, an attacker can use these characters to exit the comment context and inject arbitrary YAML at column 0 of the document body. This allows for the injection of top-level keys, overriding existing values, or using document markers (---) to split the output. The issue is fixed in version 5.1.6.
Affected products
- ufirstgroup ymlr 0.0.1 to 5.1.5
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory
- 2026-07-31: patched
References
- https://repo.hex.pm/
- https://github.com/
- https://cna.erlef.org/cves/CVE-2026-65636.html
- https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc
- https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc
- https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9