Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Refitter can run attacker code from crafted OpenAPI

CVE-2026-63344 · published 1 day ago
Summary

The Refitter tool that creates C# API clients could embed malicious code when it processes a specially crafted OpenAPI file. This code runs automatically when the generated library is loaded, giving an attacker control without any direct calls. Update Refitter to version 2.1.2 or later to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
christianhelle refitter < 2.1.2
Original advisory text
Refitter: C# source injection through OpenAPI content-type map keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
References
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-116Improper Encoding or Escaping of Output
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen30 Oct 2026
Sources
CVE-2026-63344 · NVD
CVE-2026-63344 · MITRE
CVE-2026-63344 · OSV
GHSA-p32v-8v8j-j534 · GHSA
Track software like this
Free during beta