CVE-2026-65636 ufirstgroup CVE debrief

Who should care

Developers and users of the ymlr module, particularly those using versions prior to 5.1.6, should review and address this vulnerability to prevent potential YAML injection attacks. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The ymlr module for Elixir fails to properly neutralize CRLF sequences in document comments, allowing attackers to inject arbitrary content into generated YAML documents. This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. The vulnerability affects ymlr from 0.0.1 before 5.1.6. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines, and data importers, parse the injected content as legitimate data. The vulnerability enables attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.

Defensive priority

Low-priority defensive review recommended due to limited attack surface and low CVSS score.

Recommended defensive actions

• Review and validate input data for Ymlr.document!/2, Ymlr.documents!/2, and Ymlr.documents/2
• Implement input validation and sanitization for comment strings
• Monitor for and address potential YAML injection attacks
• Update ymlr to version 5.1.6 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence is limited; primary official records indicate Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module). The vulnerability allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.