AIKIDO-2026-488887
ymlr is vulnerable to CRLF Injection
21
Low Risk
This Affects:
ymlrTL;DR
In ymlr, yAML injection through unescaped newlines in ymlr document comments. Ymlr.document!/2 interpolates each caller supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ymlr is vulnerable to CRLF Injection in versions 0.0.1 - 5.1.5.
How to fix this
Upgrade the ymlr library to the patch version.
Links
Fix Commits
github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dcgithub.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.