Code injection in Refitter via OpenAPI content-type map keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
Refitter, a tool that generates C# REST API clients for the Refit library, is affected before 2.1.2. Content-type keys in the OpenAPI requestBody and responses content maps are written into Refit Headers attributes without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description passes default validation, breaks out of the attribute string, and can add a top-level class with a ModuleInitializer method. That method runs attacker code when the generated assembly loads at application startup, without a call to the client.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| christianhelle | refitter | before 2.1.2 | 2.1.2 | Patch available | CNA |
- refitter Vendorchristianhelle Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
Remediation
Update Refitter to version 2.1.2, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA refitter (christianhelle) Fixed in 2.1.2
Timeline
- 2026-10-30 Threatist record created from CVE-2026-63344
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: LOW → HIGH
References
Other 7
- https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534
- https://github.com/christianhelle/refitter/pull/1178
- https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67
- https://github.com/christianhelle/refitter/releases/tag/2.1.2
- https://github.com/user-attachments/files/29394848/reproduce.sh
- https://github.com/user-attachments/files/29394851/maintainer-report.txt
- https://github.com/user-attachments/files/29394853/make_spec.py
More christianhelle vulnerabilities
- TI-2026-83435 Source injection in Refitter via OpenAPI header parameter names CVSS 4.0HIGH 8.6
- TI-2026-83423 Refitter OpenAPI $ref handling enables SSRF and local file inclusion CVSS 3.1HIGH 7.1
- TI-2026-83434 Code injection in Refitter C# client generator via OpenAPI path keys CVSS 4.0HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences