CVE-2026-63345— Refitter: C# source injection through OpenAPI path keys

Quick assessment

Affected

christianhelle refitter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Refitter 是一个利用 Refit 库生成 CREST API 客户端的工具。在 2.1.2 版本之前，OpenAPI 对象中的键会原样（verbatim）输出到 Refit 路由特性（如）中，未对引号或特殊字符进行转义或限制。攻击者可构造一个以斜杠开头、仅占一行的路径，该路径能绕过默认验证（无需使用选项），从而闭合特性字符串、接口及命名空间，并注入一个顶层文件类以重新打开生成的结构，确保生成的 C代码语法有效。其中，方法会在应用程序编译并加载生成的程序集时（即在启动阶段）执行攻击者代码，即使从未调用过

CVSS 8.6 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1587.002 · Code Signing Certificates T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Refitter: C# source injection through OpenAPI path keys

Source: CVE Program / CVE List V5

Vulnerability Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
christianhelle	refitter	< 2.1.2	-

II. Public POCs for CVE-2026-63345

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63345

请登录查看更多情报信息。

Other References for CVE-2026-63345 (7)

https://github.com/christianhelle/refitter/pull/1178 x_refsource_MISC
https://github.com/christianhelle/refitter/releases/tag/2.1.2 x_refsource_MISC
https://github.com/user-attachments/files/29395230/reproduce.sh x_refsource_MISC
https://github.com/user-attachments/files/29395229/make_spec.py x_refsource_MISC
https://github.com/user-attachments/files/29395228/maintainer-report.txt x_refsource_MISC
https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3 x_refsource_CONFIRM
https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63345

Same Patch Batch · christianhelle · 2026-10-30 · 4 CVEs total

CVE-2026-63344	8.6 HIGH	Refitter: C# source injection through OpenAPI content-type map keys
CVE-2026-63346	8.6 HIGH	Refitter: C# source injection through OpenAPI header parameter names
CVE-2026-63184	7.1 HIGH	Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

IV. Related Vulnerabilities

Same product: refitter

Same vendor: christianhelle

Same weakness: CWE-94