Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-63346: Refitter tool lets attacker run code via header name
CVE-2026-63346 · published 3 days ago
Summary
The Refitter utility that creates C# API client code can insert a malicious header name straight into the generated source file. This lets an attacker add code that runs automatically when the application starts, even if the client is never used. Update Refitter to version 2.1.2 or newer to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| christianhelle | refitter | < 2.1.2 |
Original advisory text
Refitter: C# source injection through OpenAPI header parameter names
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
References
- https://github.com/christianhelle/refitter/pull/1178 Patch
- https://github.com/christianhelle/refitter/releases/tag/2.1.2 URL
- https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6m... Vendor Advisory
- https://github.com/user-attachments/files/29395048/maintainer-report.txt URL
- https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec2... Patch
- https://github.com/user-attachments/files/29395050/make_spec.py URL
- https://github.com/user-attachments/files/29395051/reproduce.sh URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63346... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63346 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-94Code Injection
CWE-116Improper Encoding or Escaping of Output
Timeline
Published30 Oct 2026
Updated3 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta