The vulnerability in ninenines cowlib arises from cow_link:do_link/1 interpolating the target URI, rel value, and attribute keys directly into the serialized Link header without proper escaping or validation. Specifically, a '>' byte prematurely closes the URI slot, enabling injection of additional link entries with attacker-chosen rel directives. Similarly, '"' or '\' characters in the rel value can escape the quoted string and open new parameters. Attribute keys are emitted verbatim, including whitespace, '=', and '"'. Because browsers act on Link header directives like rel="preconnect", rel="preload", and rel="prerender", an attacker controlling these fields can force victim browsers to make out-of-band connections to malicious origins. This affects cowlib versions >=2.9.0 and <2.20.0.

An attacker who can influence the Link header fields in an application using vulnerable cowlib versions can inject malicious Link directives. This can cause browsers to initiate unintended network connections to attacker-controlled servers, potentially leading to privacy violations or other side effects. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attacker's privileges, no user interaction, and limited impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid round-tripping parsed Link headers through cow_link:link/1 with untrusted input or sanitize and validate all Link header components to prevent injection of special characters.