YQL: From CR/LF injection to root compromise