cowlib’s SSE encoder fails to neutralize CR characters while LF characters are allowed, creating a CRLF injection flaw that enables an attacker to append additional SSE lines. The attacker can forge events with arbitrary event types and data, leading to client‑side logic manipulation and stored‑XSS‑equivalent effects when the data is injected into the DOM. This is a CWE‑93 Input Validation weakness that permits injection and XSS‑like outcomes.

The vulnerability affects the cowlib library maintained by ninenines, from version 2.6.0 and later. No other vendors are impacted. Applications that use cow_sse:event/1 to deliver Server‑Sent Events are exposed.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is currently unavailable. The issue is not listed in the CISA KEV catalog. Exploitation requires simply that an attacker can send CR or LF characters into the id, event, data, or comment fields sent to cow_sse:event/1. In typical deployments, browsers consume the forged events and may trigger unintended handling or DOM manipulation, posing a moderate to high risk for exposed services with minimal prerequisites.