CVE-2026-63346— Refitter: C# source injection through OpenAPI header parameter names

Quick assessment

Affected

christianhelle refitter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Refitter 是一个利用 Refit 库生成 CREST API 客户端的工具。在 2.1.2 版本之前，当中的参数名指定为时，该名称会被原样（未经转义）嵌入到 Refit 的属性字符串中，导致引号未被正确转义。攻击者可利用受其控制的 OpenAPI 描述文件，在不使用选项的情况下通过默认验证，并通过闭合参数列表、方法语法、属性、接口及命名空间等结构，从参数列表位置“逃逸”。生成的文件在保持有效 C代码的同时，可包含一个顶层文件类，其中带有方法；该方法会在编译后的程序集于应用程序启动时加载时执行攻击者

CVSS 8.6 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Refitter: C# source injection through OpenAPI header parameter names

Source: CVE Program / CVE List V5

Vulnerability Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
christianhelle	refitter	< 2.1.2	-

II. Public POCs for CVE-2026-63346

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63346

请登录查看更多情报信息。

Other References for CVE-2026-63346 (7)

https://github.com/christianhelle/refitter/pull/1178 x_refsource_MISC
https://github.com/christianhelle/refitter/releases/tag/2.1.2 x_refsource_MISC
https://github.com/user-attachments/files/29395051/reproduce.sh x_refsource_MISC
https://github.com/user-attachments/files/29395050/make_spec.py x_refsource_MISC
https://github.com/user-attachments/files/29395048/maintainer-report.txt x_refsource_MISC
https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8 x_refsource_CONFIRM
https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63346

Same Patch Batch · christianhelle · 2026-10-30 · 4 CVEs total

CVE-2026-63345	8.6 HIGH	Refitter: C# source injection through OpenAPI path keys
CVE-2026-63344	8.6 HIGH	Refitter: C# source injection through OpenAPI content-type map keys
CVE-2026-63184	7.1 HIGH	Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

IV. Related Vulnerabilities

Same product: refitter

Same vendor: christianhelle

Same weakness: CWE-94