Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-63345: Refitter can embed malicious code in generated C# client
CVE-2026-63345 · published 3 days ago
Summary
The Refitter tool that creates C# API clients copies OpenAPI path names directly into code without cleaning them. An attacker who can control those path names could inject code that runs whenever the generated client is built and loaded. Update Refitter to version 2.1.2 or later to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| christianhelle | refitter | < 2.1.2 |
Original advisory text
Refitter: C# source injection through OpenAPI path keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
References
- https://github.com/christianhelle/refitter/releases/tag/2.1.2 URL
- https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3... Vendor Advisory
- https://github.com/user-attachments/files/29395228/maintainer-report.txt URL
- https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725... Patch
- https://github.com/christianhelle/refitter/pull/1178 Patch
- https://github.com/user-attachments/files/29395229/make_spec.py URL
- https://github.com/user-attachments/files/29395230/reproduce.sh URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63345... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63345 Vendor Advisory
Severity
9.9
Critical
Type
CWE-94Code Injection
CWE-1116Inaccurate Source Code Comments
Timeline
Published30 Oct 2026
Updated3 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta