CVE-2026-63345
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Refitter prior to 2.1.2 emits OpenAPI `paths` object keys verbatim into Refit route attributes without escaping quotation marks. A crafted single-line, slash-prefixed path can close the attribute, interface, and namespace and inject a top-level class with a `[ModuleInitializer]` method that executes attacker code when the generated assembly is loaded. The issue is fixed in version 2.1.2.
Risk Assessment
If an organization generates a C# client from an untrusted or external OpenAPI description, an attacker can achieve arbitrary code execution at application startup, even without calling the generated client. This can lead to full compromise of the build or runtime environment.
Recommendation
Upgrade Refitter to version 2.1.2 or later and generate clients only from trusted OpenAPI descriptions. Consider reviewing generated code before compilation.
Other vulnerabilities in Refitter
See all- CVE-2026-63346High
In Refitter prior to 2.1.2, the header parameter name in parameters[].name with in: header is emitted verbatim into a Refit [Header("<name>")] attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without --skip-validation and break out of the parameter-list position, generating valid C# with a file class and [ModuleInitializer] method that executes attacker code when the compiled assembly is loaded.
- CVE-2026-63344High
Refitter prior to 2.1.2 emits content-type keys from `requestBody/responses` content maps verbatim into a Refit `[Headers(...)]` attribute string without escaping quotation marks. A crafted content-type key in an OpenAPI description can break out of the attribute, interface, and namespace and inject a top-level class with a `[ModuleInitializer]` method that executes attacker code when the generated assembly is loaded. The issue is fixed in version 2.1.2.
- CVE-2026-63184High
In the refitter dotnet tool prior to 2.1.1, NJsonSchema is invoked with unsafe $ref resolution defaults when generating Refit interfaces from attacker-controlled OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted content, while absolute local paths and ../ traversal allow arbitrary local-file disclosure. The chain stops at SSRF, remote file inclusion, and local file inclusion, not code execution.
Original NVD description (English source)
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS