Refitter is a tool for generating a C# REST API client using the Refit library.
CVE-2026-63345
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as [Get(" ")] without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without --skip-validation and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A [ModuleInitializer] method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Assessment
- CVSS
- 8.6 (v4.0)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 30 October 2026
- Last updated
- 30 October 2026
- Affected
- christianhelle
- Assigner
- GitHub_M
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3
- https://github.com/christianhelle/refitter/pull/1178
- https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973
- https://github.com/christianhelle/refitter/releases/tag/2.1.2
- https://github.com/user-attachments/files/29395228/maintainer-report.txt
- https://github.com/user-attachments/files/29395229/make_spec.py
- https://github.com/user-attachments/files/29395230/reproduce.sh
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-63345