Read the docs
TI-2026-83423 Aliases CVE-2026-63184

Refitter OpenAPI $ref handling enables SSRF and local file inclusion

Priority MEDIUM 64CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

The refitter dotnet tool before 2.1.1 generates Refit clients from OpenAPI descriptions and resolves $ref references with unsafe defaults. An attacker who supplies or influences the OpenAPI description can make the developer or CI host request remote http(s) URLs, and can inline local files through absolute paths or ../ traversal outside the input directory into the generated output (CWE-918). This enables server-side request forgery, remote file inclusion and local file disclosure, but not code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Fixed refitter (christianhelle): 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
christianhellerefitterbefore 2.1.12.1.1Patch availableCNA
  • refitter Vendorchristianhelle Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA

Remediation

Upgrade the refitter dotnet tool to version 2.1.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA refitter (christianhelle) Fixed in 2.1.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-63184
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM

References

Other 12

  • TI-2026-83435 Source injection in Refitter via OpenAPI header parameter names CVSS 4.0HIGH 8.6
  • TI-2026-83433 Code injection in Refitter via OpenAPI content-type map keys CVSS 4.0HIGH 8.6
  • TI-2026-83434 Code injection in Refitter C# client generator via OpenAPI path keys CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences