The vulnerability arises because Ymlr.document!/2 and related functions interpolate user-supplied comment strings directly into YAML output behind a single # prefix without validating or escaping line breaks. Since YAML comments end at the first line break, an attacker can inject carriage return or line feed characters to terminate the comment early and inject arbitrary YAML content at the document root level. This can manipulate the structure and content of the YAML output, potentially impacting downstream consumers such as configuration loaders or CI pipelines. The issue affects ymlr versions >=0.0.1 and <5.1.6.

An attacker who controls comment text passed to the ymlr library can inject arbitrary YAML content into generated documents. This can lead to forged or overridden YAML keys and values, and splitting the document into multiple YAML documents. Downstream systems that parse these YAML documents may process the injected content as legitimate data, potentially causing unintended behavior or configuration changes. The CVSS 4.0 base score is 2.1, indicating low severity with limited attack vector (local) and partial impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, avoid passing untrusted or attacker-controlled strings as comments to the ymlr document generation functions. Validate or sanitize comment inputs to remove CRLF characters or other control characters that could terminate comments prematurely.