The vulnerability in ninenines cowlib arises from the cow_link:do_link/1 function interpolating the target URI, rel value, and attribute keys directly into the serialized Link header without proper escaping or token-grammar validation. Specifically, a '>' byte prematurely closes the URI slot, allowing injection of additional link entries with attacker-chosen rel directives. Similarly, '"' or '\' characters in the rel value escape the quoted string, opening new parameters, and any byte in attribute keys is emitted verbatim. Because browsers act on Link header directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker controlling these fields can force browsers to make out-of-band connections to attacker-controlled origins. This vulnerability affects cowlib versions from 2.9.0 onward.

An attacker who can influence the Link header fields processed by cow_link:link/1 can inject malicious Link directives that cause victim browsers to initiate unintended network connections to attacker-controlled servers. This can lead to privacy violations, information leakage, or other side-channel attacks. The vulnerability does not require user interaction and can be exploited remotely over the network. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using cow_link:link/1 with untrusted input or sanitize and validate all inputs to ensure special characters are properly escaped before inclusion in Link headers.