CVE-2026-63344 Details
Description
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
A remote code execution vulnerability has been identified in Refitter, a tool for generating C# REST API clients using the Refit library. This issue affects Refitter versions prior to 2.1.2. The vulnerability arises because content-type keys in the OpenAPI specification are injected into a Refit Headers attribute without proper escaping. A crafted content-type key can break out of the attribute string and the enclosing interface and namespace, allowing the introduction of a top-level file class. This class can execute arbitrary code when the generated assembly is loaded, without requiring a call to the Refit client.
Users can upgrade to Refitter version 2.1.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67 | [email protected] | Source CodeVendor |
| https://github.com/christianhelle/refitter/pull/1178 | [email protected] | Issue TrackingVendor |
| https://github.com/christianhelle/refitter/releases/tag/2.1.2 | [email protected] | Release NotesVendor |
| https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/user-attachments/files/29394848/reproduce.sh | [email protected] | Broken LinkExploit |
| https://github.com/user-attachments/files/29394851/maintainer-report.txt | [email protected] | Broken LinkTechnical Description |
| https://github.com/user-attachments/files/29394853/make_spec.py | [email protected] | Broken LinkExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Refitter | <= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |