CVE-2026-63184

Received Received - Intake

Refitter Tool Unsafe $ref Resolution Leads to Local File Disclosure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63184

Affected Vendors & Products

Vendor	Product	Version / Range
christianhelle	refitter	< 2.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Refitter before 2.1.1 uses unsafe defaults for $ref resolution when generating C# REST API clients from OpenAPI descriptions. Attackers can exploit this by providing malicious OpenAPI files to trigger remote HTTP requests, local file reads, or server-side request forgery. The tool inlines untrusted remote or local content into generated output, leading to potential file disclosure.

Detection Guidance

Check if Refitter version 2.1.1 or later is installed. Inspect OpenAPI descriptions processed by Refitter for unsafe $ref resolution, remote http(s) references, or local file path traversals. Monitor network requests made during code generation for unexpected external or local resource access.

Impact Analysis

If you use Refitter versions before 2.1.1, an attacker could craft an OpenAPI file that causes your system to make unauthorized HTTP requests, read sensitive local files, or expose internal network resources. This could lead to data leaks or network reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance breaches if exploited.

Mitigation Strategies

Upgrade Refitter to version 2.1.1 or later. Avoid using untrusted OpenAPI descriptions. Disable automatic $ref resolution for remote or local file paths in NJsonSchema configuration. Review generated code for suspicious inclusions before use.

Hi! I’m here to help you understand CVE-2026-63184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70