You can use the same trick as can be used with
<link rel="canonical" accesskey="X" onclick="alert(1)" />
On Linux, use ALT+SHIFT+X to trigger the payload. IMHO it's enough to report the issue and get it fixed, but it does require some unlikely user interaction.
Other than that, I see no way to exploit this in a modern browser without further code.
link tag supports the
onload attribute, it only fires when something is successfully loaded, eg:
<link rel="stylesheet" href="http://localhost/test.css" onload="alert(1)">
If your injection were
<link href="[user input]" rel="canonical">, then you could exploit it via
http://somedomain/somecsssfile.css" rel="stylesheet" onload="alert(1).
The WHATWG spec defines that the first attribute must be used, so it is unlikely that any browser would use the second, so this will not work for your case.
I tried all other event attributes, and none trigger on a normal page load.
This blog post states that this would be exploitable under IE7 and IE8 by injecting a