Improper Neutralization of Line Delimiters

Line delimiters, such as \n or \r\n, are special characters that structure data by marking the end of a line. When an attacker can inject these characters into input fields, they can manipulate how downstream systems—like log parsers, configuration files, or data processors—interpret the data stream. This can trick the receiving component into processing malicious content as separate commands or records, leading to data corruption, security bypasses, or unintended system behavior. In practice, this flaw often manifests when an application blindly trusts input without validation. For example, an attacker might inject a newline into a form field that gets written to a log file, later causing a log analysis tool to misinterpret entries. To prevent this, developers must treat all line-breaking characters as control elements, not data, and implement strict input validation and output encoding specific to the context where the data will be used.