Make sure that version directory name, jar file name, json file name, and id property in version json file is all same.
If you copy version json file from vanilla version json file, you should remove downloads property in version json file to prevent launcher overwrites your custom version jar file with vanilla version file.
All version which Mojang launcher can launch also can be launched by CmlLib.Core. Make sure that your custom version works well in Mojang launcher before using CmlLib.Core. CmlLib.Core wouldn't able to launch your version if Mojang launcher can't.
Minecraft launched by CmlLib 0.0.1 ~ CmlLib.Core 3.3.3 may have log4j2 vulnerability. It is safe after CmlLib.Core 3.3.4 version.