The vulnerability in cowlib's cow_sse:event/1 function stems from inadequate filtering of carriage return characters in SSE event fields such as id and event. While newline characters (\n) are guarded against, bare carriage returns (\r) are not, and the internal prefix_lines/2 function only splits on \n. Since SSE decoders treat \r\n, \r, and \n equivalently as line terminators, an attacker controlling these fields can inject additional SSE lines, forging complete events with arbitrary types and data. This enables event splitting and injection attacks, potentially leading to client-side logic manipulation and stored-XSS-equivalent impacts in typical browser EventSource clients. The issue affects cowlib versions from 2.6.0 up to but not including 2.16.1.

Successful exploitation allows an attacker to inject arbitrary SSE events, which can manipulate client-side event handling logic and cause stored cross-site scripting (XSS)-equivalent effects when event data is inserted into the DOM. This can compromise the integrity of client-side applications relying on SSE from cowlib, potentially leading to unauthorized script execution in users' browsers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor the ninenines project for updates addressing this vulnerability. Until a patch is available, consider implementing input validation or sanitization on fields used in SSE events to block carriage return characters or other control characters that could enable injection.