CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body. An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected. This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr from 0.0.1 before 5.1.6.

• CWE-93

• https://cna.erlef.org/cves/CVE-2026-65636.html
• https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc
• https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc
• https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9
• https://osv.dev/vulnerability/EEF-CVE-2026-65636

Published

Jul 31, 2026

Last Modified

Aug 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65618Improper URL validation when handling specific URLs, allows …6.5
• CVE-2026-6562A flaw has been found in dameng100 muucmf 1.9.5.20260309. Im…7.3
• CVE-2026-65623Inefficient Algorithmic Complexity vulnerability in mtrudel …8.7
• CVE-2026-65624Allocation of Resources Without Limits or Throttling vulnera…6.9
• CVE-2026-6563A vulnerability has been found in H3C Magic B1 up to 100R004…8.8
• CVE-2026-65635Improper Isolation or Compartmentalization vulnerability in …8.3
• CVE-2026-6564A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0…4.3
• CVE-2026-6565The Style Kits – Advanced Theme Styles for Elementor, Elemen…6.4
• CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent…4.3
• CVE-2026-65655When OAuth authentication is enabled and browser-facing TLS …2.3
• CVE-2026-65656Improper neutralization of special elements used in a comman…7.8
• CVE-2026-65657Use after free in Microsoft Office allows an unauthorized at…7.8