CVE-2026-63344— Refitter: C# source injection through OpenAPI content-type map keys

Quick assessment

Affected

christianhelle refitter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Refitter 是一个利用 Refit 库生成 CREST API 客户端的工具。在 2.1.2 版本之前，内容映射中的键会被原样输出到 Refit 的属性字符串中，而未对引号进行转义处理。攻击者可构造一个恶意的键，该键在未经参数的默认验证下仍能通过，从而突破属性字符串、接口及命名空间的限制，并注入一个顶层文件类，同时保持生成的 C代码在语法上有效。该顶层类中包含一个方法，当生成的程序集在应用程序启动时加载，该方法便会执行攻击者代码，且无需调用客户端即可触发。此行为已在 Refitter 2.0.0

CVSS 8.6 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1569.002 · Service Execution T1203.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Refitter: C# source injection through OpenAPI content-type map keys

Source: CVE Program / CVE List V5

Vulnerability Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
christianhelle	refitter	< 2.1.2	-

II. Public POCs for CVE-2026-63344

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63344

请登录查看更多情报信息。

Other References for CVE-2026-63344 (7)

https://github.com/christianhelle/refitter/pull/1178 x_refsource_MISC
https://github.com/christianhelle/refitter/releases/tag/2.1.2 x_refsource_MISC
https://github.com/user-attachments/files/29394848/reproduce.sh x_refsource_MISC
https://github.com/user-attachments/files/29394853/make_spec.py x_refsource_MISC
https://github.com/user-attachments/files/29394851/maintainer-report.txt x_refsource_MISC
https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534 x_refsource_CONFIRM
https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63344

Same Patch Batch · christianhelle · 2026-10-30 · 4 CVEs total

CVE-2026-63345	8.6 HIGH	Refitter: C# source injection through OpenAPI path keys
CVE-2026-63346	8.6 HIGH	Refitter: C# source injection through OpenAPI header parameter names
CVE-2026-63184	7.1 HIGH	Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

IV. Related Vulnerabilities

Same product: refitter

Same vendor: christianhelle

Same weakness: CWE-94