The vulnerability in cowlib's cow_link:do_link/1 function arises because it directly interpolates the target URI, rel value, and attribute keys into the serialized Link header without proper escaping or validation. Specifically, a '>' byte in the target URI prematurely closes the URI slot, enabling injection of additional link entries with attacker-controlled rel directives. Similarly, '"' or '\' characters in the rel value can escape the quoted string and open new parameters. Attribute keys are emitted verbatim, including whitespace, '=', and '"' characters. Since browsers act on Link header directives like rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in applications that use cow_link:link/1 can cause browsers to make out-of-band connections to attacker-controlled servers. This affects cowlib version 2.9.0.

An attacker able to control the inputs to cow_link:link/1 can inject malicious Link header directives that cause victim browsers to initiate connections to attacker-controlled origins. This can lead to privacy leaks, tracking, or other unintended network interactions. The vulnerability does not require user interaction and can be exploited remotely over the network. However, exploitation requires the ability to influence the Link header fields processed by cowlib.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid passing untrusted input directly to cow_link:link/1 or apply manual escaping and validation of Link header components to prevent injection of special characters.