The vulnerability in ninenines cowlib arises from the cow_link:do_link/1 function interpolating the target URI, rel value, and attribute keys directly into the serialized Link header without proper escaping or token-grammar validation. Specifically, a '>' character in the target URI prematurely closes the URI slot, enabling the injection of additional link entries with attacker-chosen rel directives. Similarly, '"' or '\' characters in the rel value can escape the quoted string and open new parameters, while any byte in attribute keys is emitted verbatim. Because browsers act on Link header directives like rel="preconnect", rel="preload", and rel="prerender", an attacker controlling these fields in an application that processes Link headers through cow_link:link/1 can force browsers to initiate connections to attacker-controlled origins. This vulnerability affects cowlib versions >=2.9.0 and specific older versions listed, and is identified as CWE-116.

An attacker able to influence Link header fields in an application using vulnerable cowlib versions can cause victim browsers to perform out-of-band connections to attacker-controlled servers. This can lead to privacy violations, potential information leakage, or other side-channel impacts depending on the attacker's control of the linked resources. The vulnerability does not require user interaction and can be exploited remotely without privileges. The CVSS vector indicates low attack complexity and no user interaction, with partial impact on integrity and availability, resulting in a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input directly into cow_link:link/1 or ensure proper escaping and validation of Link header components to prevent injection of special characters. Monitor vendor channels for updates and apply official patches once released.