ymlref allows code injection. References https://nvd.nist.gov/vuln/detail/CVE-2018-20133 https://github.com/dexter2206/ymlref/issues/2 https://github.com/advisories/GHSA-8r8j-xvfj-36f9
